page-ledgr-eng[.]pages[.]dev

page-ledgr-eng.pages.dev was observed on July 29, 2026 as part of an active generic phishing campaign. The domain resolves to the IPv4 address 172.66.44.79 and is served from Cloudflare’s network, using the authoritative nameservers clarissa.ns.cloudflare.com and vicky.ns.cloudflare.com. Registration details show the domain was provisioned through Cloudflare, Inc., which is a common hosting choice for malicious operators seeking rapid deployment and DDoS mitigation.

The domain is currently listed on a public security blocklist and has been explicitly blocked by the PhishDestroy feed, indicating that at least one threat‑intelligence provider has confirmed malicious use. VirusTotal analysis shows that six out of ninety‑one scanning engines have flagged the domain as malicious, reinforcing the suspicion raised by the blocklist entry. No additional public reputation services, such as Google Safe Browsing or OTX, are referenced in the available data, and the page title or any brand targets have not been disclosed, leaving the exact lure or credential‑harvesting technique unknown.

Defenders should prioritize denying any outbound connections to 172.66.44.79, adding page-ledgr-eng.pages.dev to local DNS blocklists, and ensuring that email filters flag URLs containing the domain. Continuous monitoring of the Cloudflare nameserver records is advised, as changes may indicate a shift in infrastructure. Because the domain is actively flagged, intrusion‑detection systems should generate alerts on any attempted HTTP or HTTPS requests, and incident‑response teams should treat any credential submissions to this host as compromised.