ledger-supply[.]com

Analysis of the domain ledger-supply.com indicates active infrastructure associated with a crypto drainer phishing campaign, as of July 26, 2026. The domain is registered through Dynadot Inc and remains operational, returning an HTTP 200 status code, suggesting the server is actively serving content. Infrastructure review reveals nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, which may be part of a broader pattern observed in similar threat activity. Detection data from VirusTotal shows 17 of 91 security vendors flagging the domain, though the specific nature of these detections—whether related to phishing, malware, or other malicious activity—is not detailed in available intelligence.

The domain appears on one security blocklist and is blocked by PhishDestroy, further corroborating its classification as malicious. No specific brand impersonation or page content analysis is available at this time, limiting conclusions about the exact targeting methodology or victim interaction flow. However, the classification as a crypto drainer implies the site likely attempts to trick users into connecting cryptocurrency wallets, subsequently draining funds through malicious scripts.

Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Additional monitoring of associated IP addresses, SSL certificates, or hosting providers may reveal linked infrastructure. Given the domain's active status and detection by multiple security vendors, organizations handling cryptocurrency transactions or wallet services should ensure users are warned against interacting with ledger-supply.com or any related subdomains.