www-llagder[.]net

This domain, www-llagder.net, is flagged as an active phishing threat with a high-risk classification. Registered on July 4, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP 172.67.215.221, hosted on AS13335 (Cloudflare, Inc.) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (arushi.ns.cloudflare.com and louis.ns.cloudflare.com) and technologies including Cloudflare Browser Insights and HTTP/3. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns leveraging legitimate CDN infrastructure to evade detection. The page title, 'Access Restricted,' suggests an attempt to mimic access control mechanisms, though the exact content or targeted brand remains unconfirmed. The domain is currently blocked by at least three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating prior detection by industry tools. A VirusTotal scan reports one security vendor flagging the domain, though this should not be interpreted as exhaustive validation. The HTTP status code 520 (Cloudflare-specific server error) may indicate backend instability or takedown attempts, though the domain remains operational as of July 12, 2026. Defenders should treat this domain as malicious based on its registration recency, Cloudflare-hosted infrastructure, and blocklist presence. Immediate action includes blocking the domain and IP at network perimeters, monitoring for connections from internal assets, and reviewing logs for prior interactions. Further analysis of the site’s content—if accessible—could clarify the phishing kit or targeted brand, but current evidence supports proactive containment without waiting for additional confirmation.