ldr-8fds[.]glema12[.]workers[.]dev

The domain ldr-8fds.glema12.workers.dev was registered on 2026-02-21 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.67.215.227, which is announced by AS13335 in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS handshake despite the malicious intent. Passive scans show the site employing HSTS, Cloudflare’s WAF and HTTP/3, consistent with the hosting provider’s default stack. VirusTotal has recorded 18 positive detections out of 95 scanners, and the domain appears on at least one public blocklist, where it has also been taken down by the PhishDestroy takedown service.

A Gridinsoft trust score of 0 / 100 further reflects the high risk assessment. The HTTP response currently returns 403 Forbidden, and the domain is flagged as offline, suggesting the content has been removed or the server is refusing connections. The page title reported by scanners is "Ledger Live", and the intelligence explicitly lists the brand target as "ledger" with a crypto‑scam classification.

No additional content has been captured, so the exact phishing page layout, credential collection fields, or malicious payloads remain unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑use of the same IP or Cloudflare‑assigned sub‑domains, and add the host to internal threat‑intel feeds. Future investigations should focus on retrieving archived snapshots, if any, to confirm the lure used against Ledger users and to identify any associated command‑and‑control infrastructure.