ledh7vg[.]testnet-de6[.]workers[.]dev

The domain ledh7vg.testnet-de6.workers.dev was observed delivering a brand‑impersonation campaign targeting Ledger users. The site returned an HTTP 403 status, indicating restricted access, and its HTML title was reported as "Ledger Live," directly matching the Ledger brand. Infrastructure analysis shows the domain resolves to IP address 172.67.206.127, which belongs to AS13335 operated by Cloudflare, Inc., and the IP geolocation is the United States. Registration records list Cloudflare, Inc. as the registrar, and no authoritative nameservers were identified (NS_NOT_FOUND).

The hosting environment employs HSTS, Cloudflare edge services, and HTTP/3, confirming a modern TLS configuration. The SSL certificate is issued by Google Trust Services under the WE1 designation, further confirming the use of a standard public‑key infrastructure. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, suggesting a high confidence in malicious intent. The domain appears on a single security blocklist and has been flagged by PhishDestroy.

VirusTotal analysis shows 14 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion of a crypto‑related scam. The overall risk assessment is elevated, and the site is currently offline. Defenders should immediately block the fully qualified domain name and its resolved IP address at network perimeters, update URL filtering policies to include the observed blocklist entry, and monitor for similarly structured workers.dev subdomains registered through Cloudflare that reference Ledger or other cryptocurrency services. Continuous threat‑intel feeds should be consulted for new indicators, and any inbound traffic to the domain should be logged for forensic correlation.