leger-us-cnd[.]pages[.]dev

Analysis of leger-us-cnd.pages.dev, observed on July 29 2026, confirms that the domain is currently active and classified as a generic phishing site with an elevated risk rating. Infrastructure data shows the domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare’s edge network, and the domain is registered through Cloudflare, Inc. The authoritative nameservers listed are elmo.ns.cloudflare.com and irma.ns.cloudflare.com, indicating the use of Cloudflare’s DNS services for rapid deployment and potential obfuscation. Reputation checks reveal that the domain appears on one external security blocklist and is explicitly blocked by the PhishDestroy service, adding further evidence of malicious intent.

VirusTotal scans report that 11 of 91 security vendors have flagged the domain, demonstrating a moderate consensus among detection engines that the site is suspicious. No additional data such as Safe Browsing verdicts, Open Threat Exchange (OTX) entries, SSL certificate details, HTTP response codes, or page title information are presently available, leaving those aspects unverified. Given the observed indicators—Cloudflare‑based hosting, blocklist presence, multiple vendor detections, and confirmation from a dedicated anti‑phishing feed—defenders should treat any network traffic to or from leger-us-cnd.pages.dev as hostile.

Recommended mitigations include adding the domain to deny‑list controls at perimeter firewalls, DNS resolvers, and endpoint protection platforms, monitoring for outbound connections to the IP 188.114.97.3, and employing URL filtering solutions that reference both blocklist and vendor detection data. Continuous re‑evaluation is advised, as further intelligence such as page content analysis or additional vendor signals could refine the threat posture.