ldgrsafkh87f[.]sameera-45[.]workers[.]dev

The domain ldgrsafkh87f.sameera-45.workers.dev is identified as a brand impersonation threat targeting Ledger. The domain was created on May 19, 2026, and is designed to deceive users by mimicking the appearance and functionality of the legitimate Ledger Live platform. This impersonation can lead to unauthorized access to user credentials and sensitive financial information.

Infrastructure analysis reveals that the domain resolves to the IP address 172.67.219.110, which is associated with Cloudflare, Inc., and is located in California, USA. The domain is registered through Cloudflare, Inc., and utilizes an SSL certificate from Google Trust Services / WE1. VirusTotal reports a detection score of 18/95, indicating that 18 out of 95 security vendors flag this domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. It was created on May 19, 2026, and has been identified as part of a campaign to impersonate Ledger.

The current status of the domain is offline, suggesting that it has been taken down. However, the risk remains elevated due to the potential for the domain to be reactivated or repurposed in future attacks. Security teams are advised to monitor for any re-emergence of this domain and to educate users on the importance of verifying URLs and SSL certificates before entering sensitive information. Additionally, users should be encouraged to report any suspicious activity and to use multi-factor authentication to enhance their account security.