en-us-leedegr[.]pages[.]dev

Analysis of en-us-leedegr.pages.dev shows the domain is hosted on Cloudflare’s edge network, resolving to 172.66.47.104. The authoritative name servers are carl.ns.cloudflare.com and clara.ns.cloudflare.com, indicating the registrar is Cloudflare, Inc. The domain appears on a single security blocklist and has been flagged by the PhishDestroy sinkhole, which classifies it as a generic phishing site. VirusTotal has processed the domain with 91 scanning engines; none have raised a detection at the time of the scan, but the absence of alerts does not constitute a validation of legitimacy.

No additional intelligence such as SSL certificate details, HTTP response codes, page title, or brand targeting is currently available, leaving the exact content and lure technique unverified. The limited visibility suggests the operators rely on Cloudflare’s privacy and rapid provisioning to obscure attribution. Defenders should add the domain to inbound and outbound filtering rules, monitor DNS queries for the IP address 172.66.47.104, and enforce blocklist updates that include this entry.

Continuous re‑inspection of the site’s HTTP payload and any future VirusTotal submissions is recommended to capture potential changes in malicious behavior. Organizations that employ email or web gateway protections should ensure that traffic to this domain is either blocked or subjected to strict content inspection to mitigate credential harvesting attempts.