en-us-ledgire[.]pages[.]dev

Analysis conducted on July 29, 2026 identifies en-us-ledgire.pages.dev as an active phishing domain hosted on Cloudflare infrastructure. The domain resolves to IP address 172.66.47.125, which is part of Cloudflare's network, and uses Cloudflare nameservers daisy.ns.cloudflare.com and titan.ns.cloudflare.com. Detection data from VirusTotal indicates that 9 of 91 security vendors flag this domain as malicious, aligning with its presence on at least one security blocklist and its prior blocking by PhishDestroy. No specific brand impersonation or phishing kit has been confirmed at this time, and the exact content of the site remains unanalyzed.

However, the use of Cloudflare Pages (.pages.dev) for phishing is a known tactic, as it provides free, SSL-enabled hosting with minimal registration barriers. The domain's registration details are consistent with Cloudflare's standard provisioning, offering limited attribution value. Defenders should treat this domain as an active threat.

Recommended actions include blocking the domain and its resolving IP at network and endpoint layers, monitoring for connections to 172.66.47.125, and reviewing logs for any prior interactions. Given the domain's detection by multiple security vendors, organizations using PhishDestroy or similar tools may already have protections in place. Additional analysis of the site's content and payloads is advised to determine the specific phishing campaign and targeted brands, if any.