access-ldgerdekstop[.]pages[.]dev

access-ldgerdekstop.pages.dev was first observed on September 24 2025 when the DNS record was registered via Cloudflare Pages. The domain resolves to the IP address 188.114.96.3, which is part of Cloudflare's edge network and does not reveal a dedicated backend host. The domain has been listed on a single security blocklist and is actively blocked by the PhishDestroy service, indicating that at least one defensive feed has identified it as malicious.

VirusTotal analysis shows that 13 of 91 scanning engines flag the domain as malicious, reinforcing the suspicion of phishing use. No public SSL certificate details, HTTP status codes, or page title information are currently available in the intelligence set, so the exact content served by the site remains unverified. The lack of additional blocklist entries or broader detection suggests the campaign may be in an early deployment stage or using a low‑profile hosting strategy to avoid rapid takedown.

Defenders should continue to block the domain at perimeter filters, update URL filtering lists with the observed indicator, and monitor traffic to the associated IP address for any anomalous request patterns. Because the domain is hosted on Cloudflare Pages, any takedown request should be directed to Cloudflare’s abuse handling portal, referencing the registration date and the detection evidence. Ongoing observation is recommended to capture any changes in the site’s behavior, additional detection votes, or new threat‑intel reports that could clarify the phishing payload or targeted brand.