ledhfj-jihghjg[.]pages[.]dev

This report documents the infrastructure and detection footprint associated with ledhfj-jihghjg.pages.dev as of July 29 2026. The domain is hosted on Cloudflare’s platform, indicated by the authoritative nameservers howard.ns.cloudflare.com and stevie.ns.cloudflare.com and by registration through Cloudflare, Inc. DNS resolution points to the IPv4 address 172.66.46.221, which is part of Cloudflare’s edge network and therefore masks the true origin of the web server. The site has been classified as a generic phishing object and is currently listed as active with an elevated risk rating. Independent scanning on VirusTotal shows that thirteen of ninety‑one security engines have flagged the domain as malicious, suggesting observable artifacts such as malicious payloads, suspicious redirects, or known phishing signatures.

The domain is also present on a single external blocklist and has been explicitly blocked by the PhishDestroy remediation service, confirming that at least one security vendor has taken automated mitigation action. No additional metadata such as SSL certificate details, HTTP response codes, page title, or brand targeting is available from the supplied intelligence, leaving the exact content and lure techniques unverified. Consequently, analysts cannot confirm whether the page mimics a particular service or captures credentials for a specific brand. The lack of visible page‑level indicators limits attribution but does not diminish the observed malicious classification.

Defenders should prioritize immediate containment of traffic to ledhfj-jihghjg.pages.dev. Recommended actions include adding the domain to network‑level deny lists, updating web‑proxy and DNS filtering rules, and ensuring endpoint protection tools receive the latest indicator feeds. Continuous monitoring of Cloudflare‑associated IP ranges for new phishing deployments is advisable, as the underlying hosting model permits rapid re‑deployment of similar payloads.