ldr-df45-sdfsd[.]asd897[.]workers[.]dev

The domain ldr-df45-sdfsd.asd897.workers.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned IP address 188.114.97.3 located in Canada. The site presented a page title identical to the domain name and employed HSTS, HTTP/3, and a Google Trust Services / WE1 SSL certificate. HTTP requests returned a 403 status code, and the domain is currently taken offline. Threat intelligence indicates that the site was used for credential phishing, as classified by the provided scam type.

Detection services flagged the domain, with 15 of 93 VirusTotal security vendors marking it as malicious. It appears on a single security blocklist and received a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment. PhishDestroy also listed the domain as blocked.

While the exact phishing payload and targeted brands are not disclosed, the combination of a low trust score, multiple vendor detections, and blocklist inclusion confirms a high likelihood of credential harvesting activity. Defenders should immediately add the domain and its resolving IP 188.114.97.3 to outbound and inbound deny lists, enforce DNS sinkholing for the host, and monitor Cloudflare Workers subdomains for similar patterns. Continuous review of Cloudflare‑registered domains for rapid creation dates and low trust scores is recommended, as is periodic re‑query of VirusTotal and other multi‑vendor scanners to capture any new detections.