en-bridges-usa[.]pages[.]dev

This domain is flagged as a generic phishing threat with elevated risk. As of July 29, 2026, it is actively resolving and presents a clear danger to users. Analysis relies on available intelligence, which shows the domain appears on one security blocklist, specifically PhishDestroy, and is detected by 12 of 91 security vendors on VirusTotal. The domain was created on September 8, 2025, and registered through Cloudflare Pages, a common hosting service for both legitimate and malicious sites. No additional details are available about the page title, brand impersonation, or specific scam kit used; the exact content of the site has not been analyzed.

The high detection rate among security vendors indicates broad consensus on the domain's malicious nature. Defenders should immediately block this domain at the network or email gateway level to prevent user exposure. Given its active status, it is likely still being used in ongoing phishing campaigns. Organizations should review logs for any connections to en-bridges-usa.pages.dev and investigate potential credential compromise or data exfiltration.

The absence of Safe Browsing, OTX, or other intelligence sources in the known data means defenders cannot rely on those checks alone; the existing strong signals from vendors and blocklists are sufficient to warrant action. Users should be warned not to interact with the domain via any links or attachments. Continued monitoring is recommended as the domain may change hosting or redirect to additional malicious infrastructure. The domain remains active at the time of this report.