ldgrijsjbhj[.]malibu02[.]workers[.]dev

This domain, ldgrijsjbhj.malibu02.workers.dev, is identified as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The page title, "Ledger Live," directly mimics the legitimate Ledger management interface, suggesting an intent to deceive users into interacting with fraudulent content. No specific drainer kit signatures were confirmed, but the domain aligns with known tactics used in cryptocurrency-related credential theft and wallet compromise schemes. Analysis indicates the domain was registered through Cloudflare, Inc. on May 21, 2026, and resolves to the IP address 188.114.96.3. It is flagged by 17 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on three security blocklists and is blocked by MetaMask, PhishDestroy, and SEAL. Detected technologies include Bootstrap, jQuery CDN, jQuery, HSTS, Cloudflare, and HTTP/3, with an SSL certificate issued by Google Trust Services. The domain is currently offline, having been taken down following detection. While no active threat remains, prior exposure to this domain may have resulted in credential theft or unauthorized access to cryptocurrency wallets. Users who interacted with this domain are advised to revoke any connected wallet permissions, reset credentials, and monitor for unauthorized transactions. Infrastructure analysis reveals the use of Cloudflare Workers, a common tactic for rapidly deploying and rotating malicious domains.