vvww-lladger-app[.]net

This analysis documents the active credential‑phishing site vvww‑lladger‑app.net. The domain was registered on 3 July 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335, United States). The authoritative nameservers are arushi.ns.cloudflare.com and louis.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 root. An HTTP 520 response is observed, and the page title returned is “Access Restricted”. The site appears on three blocklists—PhishDestroy, MetaMask, and SEAL—and has been flagged by one of ninety‑one VirusTotal scanners. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The threat is classified as generic_phishing with a high risk rating, and the campaign’s specific objective is credential harvesting. At present, no additional page content has been disclosed, limiting insight into the lure or data collection mechanisms. Defenders should block the domain and its associated IP at perimeter defenses, monitor DNS queries for the identified nameservers, and apply threat‑intel feeds that reference the observed blocklist entries. Continuous re‑evaluation is advised in case the infrastructure changes or additional detections emerge.