shiny-mountain-39f9[.]coteenancee[.]workers[.]dev

The domain shiny-mountain-39f9.coteenancee.workers.dev has been identified as a malicious phishing site specifically designed to target cryptocurrency users by impersonating the legitimate Ledger Live platform. This domain, now taken offline, posed a significant threat to individuals seeking to manage their crypto assets, as it attempted to steal sensitive information such as wallet credentials or private keys. The site's page title explicitly displayed 'Ledger Live,' a clear attempt to deceive users into believing they were interacting with an official service.

Technical analysis reveals that this domain was created on June 3, 2026, and was registered through Cloudflare, Inc., a common registrar for both legitimate and malicious sites. It resolved to the IP address 104.21.19.51, which is associated with Cloudflare's infrastructure. VirusTotal flagged the domain with 15 out of 95 security vendors marking it as malicious, indicating a moderate but notable consensus on its harmful nature. Additionally, the domain appeared on one security blocklist, further confirming its reputation as a threat. Trust scores, such as those from PhishDestroy's internal assessments, would have categorized this site as high-risk due to its phishing intent and impersonation of a trusted brand.

Currently, shiny-mountain-39f9.coteenancee.workers.dev is offline, which reduces immediate risk, but users should remain vigilant. PhishDestroy strongly recommends that anyone who may have visited this site or entered any credentials should immediately change their Ledger Live passwords and enable two-factor authentication. Furthermore, always verify the legitimacy of any site claiming to be a crypto service by checking official URLs and using trusted sources like PhishDestroy's database. Avoid clicking on unsolicited links, and report any similar domains to security teams to prevent future scams.