page-en-us-ledgre[.]pages[.]dev

This domain, page-en-us-ledgre.pages.dev, is flagged as an active credential phishing site operating under Cloudflare Pages infrastructure. Registered on May 4, 2026, it resolves to the IP address 172.66.45.11, associated with Cloudflare, Inc. in Canada. The domain currently returns an HTTP 200 status, indicating it is live and serving content. Analysis of available data confirms it is classified as a credential phishing threat, though the specific brand or service being impersonated has not been identified in current intelligence. Infrastructure analysis reveals the domain uses a Cloudflare Pages hosting environment, a common tactic to leverage legitimate CDN services for phishing campaigns. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate malicious activity but is consistent with domains attempting to appear legitimate. The domain is blocked by at least one security vendor, and 13 of 91 security vendors on VirusTotal have flagged it as malicious, though this detection rate alone does not confirm the full scope of the threat. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Given its active status and confirmed phishing classification, organizations are advised to monitor for any connections to this domain within their networks. Further analysis of the site's content, if accessible, may provide additional indicators of compromise or targeted brands. No evidence of takedown requests or sinkholing is present in current intelligence, so proactive mitigation is recommended.