ldr-ec34-99fgf[.]lesleec3-d52[.]workers[.]dev

The domain ldr-ec34-99fgf.lesleec3-d52.workers.dev has been identified as a phishing site engaged in brand impersonation, specifically targeting Ledger. The page title 'Ledger Live' aligns with this impersonation attempt, suggesting that the site was designed to deceive users into providing sensitive information under the guise of the legitimate Ledger service. There is no evidence of a specific drainer kit being used in this operation; however, the domain's configuration and purpose are consistent with phishing tactics aimed at financial data theft.

Technical analysis reveals significant indicators of malicious activity. VirusTotal reports that 15 out of 95 security vendors have flagged this domain for phishing. The domain is registered through Cloudflare, Inc., and resolves to the IP address 104.21.66.60, located in the United States under AS13335, also associated with Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1, which is a common practice to lend a false sense of legitimacy. The domain has been blocked by two security entities: PhishDestroy and PhishingDB, further confirming its malicious intent. The domain appears on two security blocklists, indicating recognized risk by the cybersecurity community.

As of the current status, the domain ldr-ec34-99fgf.lesleec3-d52.workers.dev is offline, likely due to takedown efforts following the detection of phishing activities. While the immediate threat is mitigated with the domain being inactive, users are advised to remain vigilant against similar phishing schemes. It is crucial to verify the authenticity of websites, particularly those requesting sensitive information, by checking official sources and using security tools to assess potential threats.