hard-leder-livlongg-access-cdn[.]pages[.]dev

Analysis conducted on July 29, 2026 identifies hard-leder-livlongg-access-cdn.pages.dev as an active phishing domain targeting cloud storage credentials. The domain is hosted on Cloudflare infrastructure, resolving to IP address 188.114.97.3 and utilizing nameservers nolan.ns.cloudflare.com and sunny.ns.cloudflare.com, consistent with Cloudflare Pages deployment. Seven of 91 security vendors on VirusTotal have flagged this domain, indicating detection by multiple engines but not yet widespread consensus.

The domain appears on one security blocklist and is actively blocked by PhishDestroy, suggesting recent confirmation of malicious intent. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., a common registrar for both legitimate and malicious sites. No specific brand target or phishing kit has been identified in available data, though the domain name structure suggests an attempt to mimic cloud storage or content delivery network services.

The exact content of the phishing page remains unanalyzed; no page title, HTTP status, or SSL certificate details are currently available. Defenders should treat this domain as elevated risk and implement blocking at network and endpoint levels. Organizations using Cloudflare Pages for legitimate services should monitor for similar domain squatting patterns, particularly those incorporating 'cdn' or 'access' in the subdomain structure.