ldr-ec34-66dgf[.]melida[.]workers[.]dev

The domain ldr-ec34-66dgf.melida.workers.dev is currently taken offline but retains observable infrastructure that matches a Ledger‑focused crypto scam. DNS resolution points to the Cloudflare‑hosted address 172.67.201.53, an IP located in the United States under ASN 13335 (Cloudflare, Inc.). The domain resolves through Cloudflare’s registration service and presents a Google Trust Services / WE1 SSL certificate, indicating a valid TLS chain. HTTP responses return a 403 status code, and the site advertises HSTS, Cloudflare and HTTP/3 support.

The page title retrieved during the brief scan reads “1 new message,” which does not disclose additional content. Security telemetry shows the domain flagged by 16 of 95 vendors on VirusTotal and listed on a single blocklist, where it is actively blocked by PhishDestroy. Gridinsoft’s trust score is 0 out of 100, reinforcing the malicious assessment. The known scam type is a crypto‑related impersonation of the Ledger brand, and the page title suggests a possible social‑engineering hook.

Nameserver information is unavailable (NS_NOT_FOUND). Given the elevated risk rating, defenders should continue to block the hostname and its associated IP at network perimeters, ensure that URL filtering solutions reference the current blocklist entry, and monitor Cloudflare‑associated subdomains for re‑registration. Continuous re‑evaluation is advised, as the domain could be re‑activated or leveraged for future credential‑harvesting campaigns targeting Ledger users.