ldgr78sahjk[.]samra2[.]workers[.]dev

The domain ldgr78sahjk.samra2.workers.dev is flagged as a high-risk brand impersonation threat targeting the cryptocurrency brand Ledger. The domain impersonates the legitimate Ledger Live service, potentially aiming to deceive users into divulging sensitive information or downloading malicious software.

Infrastructure analysis reveals that the domain is registered through Cloudflare, Inc. and resolves to the IP address 172.67.130.39. The domain was created on April 13, 2026, and is associated with a Google Trust Services SSL certificate. The domain appears on 3 security blocklists and has been flagged by 16 out of 95 security vendors on VirusTotal. The Scamadviser trust score for this domain is 1/100, and the Gridinsoft trust score is 0/100, indicating a significant level of suspicion and potential threat.

The domain is currently offline, which suggests that it may have been taken down as part of a response to the identified threat. Despite this, the offline status does not eliminate the remaining risk, as the domain could be reactivated at any time. Security teams and users should remain vigilant and avoid any interaction with this domain. Additionally, it is advisable to monitor for any related subdomains or similar impersonation attempts and to educate users about the risks of brand impersonation and the importance of verifying the authenticity of URLs and SSL certificates.