wllt-ledger-live[.]pages[.]dev

This domain, wllt-ledger-live.pages.dev, has been identified as an active crypto‑drainer infrastructure. The site is hosted on Cloudflare’s network and resolves to the IP address 172.66.44.221. Cloudflare is also the registrar, and the authoritative nameservers are joan.ns.cloudflare.com and yew.ns.cloudflare.com. The domain appears on a single security blocklist and has been flagged by the PhishDestroy feed, indicating that at least one reputable threat‑intel source has taken remediation action against it.

VirusTotal records show that the URL was submitted to 91 scanning engines; none of the engines currently flag the domain, which reflects the difficulty of detecting low‑profile crypto‑drainer payloads rather than an indication of benign behavior. No additional telemetry such as SSL certificate details, HTTP response codes, Safe Browsing status, or OTX mentions is available in the current intelligence set. The observable data confirms that the domain is being used in a campaign that attempts to exfiltrate cryptocurrency assets, but the exact mechanism—such as the targeted wallet addresses, transaction patterns, or user‑interaction flow—has not been publicly disclosed. Consequently, defenders cannot rely on a single indicator such as a specific URL path or page title to detect the malicious payload.

The lack of further public analysis also means that the prevalence of this infrastructure beyond the single blocklist entry remains uncertain. Defensive recommendations include adding the domain and its resolving IP address to network deny lists, configuring web‑proxy filters to block any HTTP(S) requests to wllt-ledger-live.pages.dev, and monitoring DNS query logs for repeated look‑ups of the associated Cloudflare nameservers. Organizations should also instrument endpoint detection to flag attempts to contact the domain, especially from processes that handle cryptocurrency wallets.