ldgrinyhgj[.]azalea1[.]workers[.]dev

Analysis of ldgrinyhgj.azalea1.workers.dev shows that the domain is actively used in a generic phishing operation and is currently listed with an elevated risk rating. The domain was created on February 08, 2019 and is hosted behind Cloudflare Workers, indicating that the attacker leveraged the Cloudflare edge network for fast content delivery and possible obfuscation. Resolution data points to the IP address 188.114.97.3, a shared address frequently observed in other malicious hosting patterns. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing platform has taken mitigation action.

VirusTotal scans report that 16 of 91 security vendors flagged the domain, providing a modest but notable detection consensus across independent scanners. No public page title or SSL certificate details are available in the supplied intelligence, so the exact content served by the site remains unverified. Defenders should continue to block any outbound connections to 188.114.97.3 and add ldgrinyhgj.azalea1.workers.dev to local DNS blocklists.

Network monitoring should flag HTTP or HTTPS requests to the domain, and intrusion detection signatures that reference the observed detection count may improve detection confidence. Because the domain is registered via Cloudflare Workers, typical takedown requests to the registrar may be less effective; instead, coordinated takedown through Cloudflare’s abuse channel is recommended. Ongoing observation of the domain’s activity, especially any changes to its resolution or detection score, will help refine risk assessments as the campaign evolves.