learn-ledgrer-liwe-acces[.]pages[.]dev

On July 29, 2026 the domain learn-ledgrer-liwe-acces.pages.dev was observed hosting a generic phishing campaign. The domain is delegated to Cloudflare’s name servers arturo.ns.cloudflare.com and arya.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. DNS resolution points to the IP address 188.114.96.3, which is part of Cloudflare’s infrastructure and does not reveal a distinct backend host. The domain appears on a single security blocklist and has been listed by PhishDestroy as malicious, confirming that at least one reputable anti‑phishing feed is already blocking it. VirusTotal has processed the domain with 91 antivirus and URL scanning engines, none of which reported a detection at the time of analysis; this lack of detection should not be interpreted as an indication of safety.

Registration details show the registrar as Cloudflare, Inc., which is consistent with the observed nameserver configuration. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or brand targeting is currently available, leaving the exact content of the landing page unverified. Because the domain uses Cloudflare’s shared hosting, attribution to a specific threat actor is difficult, and the IP address may be reused by unrelated legitimate services. Therefore, blanket blocking of the IP should be combined with domain‑specific filtering to avoid collateral impact. Defenders should add the domain and its resolved IP address to network‑level deny lists, enforce DNS sinkholing for the domain, and monitor for new sub‑domains under the pages.dev suffix that exhibit similar naming patterns.

Organizations employing web proxy or secure web gateway solutions should configure URL filtering rules to drop any HTTP(S) request to this fully qualified domain name. Endpoint detection platforms should be updated with an indicator of compromise (IOC) entry for the domain and its IP address.