get-ledgeruslive[.]pages[.]dev

This investigation covers the domain get-ledgeruslive.pages.dev, observed on 29 July 2026 as an active crypto‑drainer infrastructure. The domain was registered on 11 August 2025 through Cloudflare Pages, indicating the use of Cloudflare’s static‑site hosting service. DNS resolution points to the IP address 172.66.44.130, which belongs to Cloudflare’s edge network. VirusTotal analysis shows that 12 of 91 security vendors have flagged the domain, reflecting a moderate detection consensus.

The domain is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy service, providing additional independent confirmation of malicious intent. No public SSL certificate details, HTTP response codes, or page‑title information were supplied, limiting the ability to assess the site’s surface characteristics. The primary threat indicator is the classification as a “crypto drainer,” suggesting that the site attempts to lure victims into transferring cryptocurrency to attacker‑controlled wallets.

Defenders should treat the domain as high‑confidence malicious: ingest the domain and its resolving IP into DNS‑ and firewall block lists, monitor for outbound connections to the IP range, and correlate any internal alerts that reference the domain with the known malicious activity. Ongoing surveillance of the Cloudflare Pages account may reveal additional sub‑domains or related assets that share the same hosting provider. Given the elevated risk rating and active status, rapid containment is advised.