ldr-df45-fd4[.]abdiel33[.]workers[.]dev

This domain is flagged as a brand impersonation phishing site targeting users of Ledger, a hardware cryptocurrency wallet provider. The site mimics the official Ledger Live interface, a desktop and mobile application used for managing crypto assets, to deceive victims into entering sensitive credentials, recovery phrases, or private keys. Such attacks typically aim to gain unauthorized access to cryptocurrency wallets, enabling threat actors to steal digital assets directly from victims' accounts. The use of brand impersonation increases the likelihood of successful compromise, as users may mistake the site for the legitimate service due to visual and contextual similarities. Analysis indicates the domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, which is part of Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare Workers. At the time of assessment, 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The page title, 'Ledger Live,' further confirms the intent to impersonate the official Ledger application, a key indicator of phishing activity targeting cryptocurrency users. Users who visited this domain should assume their credentials or recovery phrases may have been compromised. Immediately disconnect any connected wallets from the internet and transfer assets to a new, secure wallet using a verified recovery phrase. Enable multi-factor authentication on all accounts associated with cryptocurrency services. Monitor transaction histories for unauthorized activity and report any suspicious transactions to the relevant platform. If sensitive information was entered, consider the original wallet and any connected devices as compromised and avoid using them for further transactions. Reset passwords on all accounts where the same credentials may have been reused.