ldr-ec34-99fgf[.]ssangyong3[.]workers[.]dev

On July 24 2026, analysis of the domain ldr-ec34-99fgf.ssangyong3.workers.dev indicates a clear case of brand impersonation targeting Ledger. The domain resolves to the Cloudflare IP address 188.114.96.3, which is geolocated to the United States and belongs to ASN 13335 owned by Cloudflare, Inc. The SSL certificate presented is issued by Google Trust Services under the WE1 root, a certificate chain commonly used by Cloudflare front‑ends, and therefore does not confirm the legitimacy of the underlying site. An HTTP request returns a 403 status code, and the site has been taken offline, with PhishDestroy reporting the domain as blocked. The page title observed before takedown was "Ledger Live," matching the targeted Ledger brand and supporting the classification as a crypto‑related impersonation. Infrastructure fingerprints show the presence of Bootstrap, jQuery, jQuery CDN, HSTS, and HTTP/3, all delivered via Cloudflare. No nameserver information was returned (NS_NOT_FOUND), and registration is listed as through Cloudflare, Inc., consistent with the hosting provider.

Detection data show that one of ninety‑five VirusTotal scanners flagged the domain, providing at least a single vendor indication of malicious activity. Gridinsoft assigned a trust score of zero out of one hundred, and the domain appears on a single external security blocklist. These concrete signals collectively suggest malicious intent despite the low count of vendor detections.

Uncertainties remain because the site is offline, preventing direct content analysis; the specific reason for the single VirusTotal detection is not disclosed, and the blocklist entry lacks detailed rationale. The absence of nameserver records limits deeper registrar investigation.

Defenders should immediately add the domain to internal deny lists and monitor DNS queries for the associated IP and ASN. Email and web security gateways must treat any communications referencing Ledger Live from this workers.