ldrmrdftr[.]esaic4[.]workers[.]dev

This domain, ldrmrdftr.esaic4.workers.dev, is identified as a brand-impersonation phishing site targeting users of Ledger, a hardware cryptocurrency wallet provider. The site replicates the Ledger Live interface, a software platform used for managing cryptocurrency assets, to deceive victims into entering sensitive credentials, such as recovery phrases or private keys. Such attacks typically lead to unauthorized access to cryptocurrency wallets, resulting in asset theft and financial loss for affected users. The domain’s infrastructure and page title alignment with Ledger Live strongly indicate a deliberate attempt to exploit trust in the Ledger brand. Analysis indicates the domain resolves to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.), a common hosting provider for both legitimate and malicious sites. The domain is registered through Cloudflare, Inc., and currently appears on one security blocklist. VirusTotal detection metrics reveal that 18 out of 95 security vendors flag this domain as malicious, a significant indicator of its threat status. The domain’s status is currently offline, suggesting takedown actions may have been initiated, though residual risk remains for users who interacted with it prior to its removal. Users who visited ldrmrdftr.esaic4.workers.dev or entered credentials on the site should immediately revoke access to any connected cryptocurrency wallets. This includes generating new recovery phrases, resetting passwords, and transferring assets to a new wallet if compromise is suspected. Additionally, affected users should monitor their accounts for unauthorized transactions and enable multi-factor authentication where available. Security teams are advised to block the domain and associated IP address (188.114.97.3) at the network level to prevent further exposure. Vigilance against similar phishing attempts is recommended, particularly those leveraging Cloudflare-hosted infrastructure.