lzrst43435hf[.]fer5rtef[.]workers[.]dev

This domain, lzrst43435hf.fer5rtef.workers.dev, is flagged as a high-risk brand impersonation threat specifically targeting Argent, a cryptocurrency wallet service. The page title, "Ledger Live," suggests an attempt to deceive users by mimicking legitimate wallet interfaces, likely to facilitate unauthorized transactions or credential harvesting. The domain is currently offline, but prior activity indicates a focused effort to exploit users of the targeted brand. Analysis reveals the domain was registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services (WE1). It resolves to the IP address 104.21.94.8, located in the United States under AS13335 (Cloudflare, Inc.). The domain was created on February 21, 2026, and has been flagged by 20 of 95 security vendors on VirusTotal. It appears on one security blocklist and was previously blocked by PhishDestroy. The infrastructure and timing suggest a deliberate campaign to impersonate Argent, leveraging Cloudflare’s hosting services to obscure its origin and evade detection. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the technical indicators—such as the use of Cloudflare Workers subdomains, the specific brand impersonation, and the SSL certificate—suggest a pattern consistent with crypto drainer or credential theft operations. Organizations and individuals are advised to block the domain and associated IP (104.21.94.8) at the network level. Users should verify wallet interfaces directly through official sources and avoid interacting with unsolicited links or prompts. Monitoring for similar subdomains under workers.dev or other Cloudflare-hosted services is recommended to preempt further attempts.