berqumi-gld-lentora-c9x2fq57[.]pages[.]dev

On 2026-08-03, analysis confirms that berqumi-gld-lentora-c9x2fq57.pages.dev is actively leveraged for phishing campaigns. The domain is hosted on Cloudflare Pages, indicating the use of Cloudflare’s static site hosting service. Google Safe Browsing has classified the URL under the social engineering category, reflecting its intent to deceive users into disclosing credentials or personal data.

Independent phishing feed providers PhishDestroy and OpenPhish have added the domain to their blocklists, and the domain appears on two additional security blocklists, increasing its visibility across defensive platforms. VirusTotal records show that 17 of 91 scanning engines have raised detections, confirming malicious behavior observed by multiple vendors. The combination of hosting on a reputable CDN and the presence on multiple blocklists makes the domain a high‑risk indicator for intrusion detection systems.

Defenders should immediately block any outbound or inbound traffic to the domain at the DNS and firewall layers, incorporate the domain into URL filtering policies, and monitor for any connections originating from internal hosts. Incident response teams should also search for signs of credential harvesting or credential reuse associated with the observed phishing attempts. Continuous re‑evaluation is advised, as additional indicators such as page title or payload characteristics may be published in future analyses.