dfg-01-01[.]rurzokerze[.]workers[.]dev

The domain dfg-01-01.rurzokerze.workers.dev has been identified as a threat due to its involvement in brand impersonation. Specifically, it impersonates the popular cryptocurrency wallet service, Ledger Live, which can mislead users into believing they are interacting with a legitimate Ledger page. This impersonation is designed to steal sensitive information, such as login credentials and personal data, from unsuspecting users.

Analysis of the domain reveals that it has been flagged by 12 out of 95 security vendors on VirusTotal, indicating a moderate level of detection and potential risk. The domain is registered through Cloudflare, Inc., and resolves to an IP address located in the United States, specifically 172.67.204.14, which is part of the AS13335 Cloudflare, Inc. network. The SSL certificate is issued by Google Trust Services / WE1, which can lend a false sense of security to users. Additionally, the domain appears on two security blocklists, PhishDestroy and PhishingDB, further confirming its malicious intent. The domain has since been taken offline, but the risk remains for users who may have interacted with it while it was active.

If users have visited dfg-01-01.rurzokerze.workers.dev, they should immediately check their Ledger account for any unauthorized activity. It is recommended to change passwords and enable two-factor authentication (2FA) if not already in place. Users should also monitor their financial transactions and credit reports for any signs of fraud. If any suspicious activity is detected, users should contact Ledger support immediately and consider reporting the incident to relevant authorities.