en-us-desktup-ledgre[.]pages[.]dev

On July 29 2026 the domain en-us-desktup-ledgre.pages.dev was observed resolving to the IPv4 address 172.66.47.61. The host is served through Cloudflare’s network, as indicated by the authoritative name servers anna.ns.cloudflare.com and tosana.ns.cloudflare.com and the registrar entry “Cloudflare, Inc.”. The IP belongs to Cloudflare’s edge infrastructure, which is commonly leveraged by threat actors to hide the true origin of malicious payloads.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that defensive feeds have identified it as a phishing vector. VirusTotal analysis shows that 7 of 91 scanned antivirus or URL‑reputation engines flagged the domain as malicious, reinforcing the likelihood of abuse. The threat classification supplied as “generic phishing” aligns with the observed infrastructure indicators, though the specific lure or targeted brand has not been disclosed in available intelligence.

No further telemetry such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, or content‑level analysis is currently published, leaving the exact phishing page composition uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, add the IP address 172.66.47.61 to any host‑based deny lists, and monitor for related sub‑domains under the same Cloudflare account. Continuous re‑scanning with URL reputation services is advised to capture any changes in detection ratios, and incident response teams should treat any credential submissions to this domain as compromised.