ledjor-live[.]pages[.]dev

The domain ledjor-live.pages.dev was observed on July 29 2026 as an active generic phishing site. Infrastructure analysis shows the domain is hosted on Cloudflare’s network and resolves to the IPv4 address 172.66.46.242. The authoritative name servers are dina.ns.cloudflare.com and harlan.ns.cloudflare.com, consistent with a Cloudflare‑registered domain. Registration details indicate the domain was provisioned through Cloudflare, Inc., and no additional registrar information is available. Threat intelligence sources list the domain on a single security blocklist and note that PhishDestroy has explicitly blocked it.

VirusTotal scans have returned eight positive detections out of ninety‑one submitted engines, confirming that multiple anti‑malware products flag the domain as malicious. The detection count suggests a moderate level of consensus among security vendors, reinforcing the elevated risk rating assigned by analysts. No public SSL certificate details, HTTP response codes, or page title information have been published for this host, and automated crawlers have not supplied content signatures. Consequently, the exact phishing lure, targeted brand, or credential‑stealing mechanism remains unknown. The lack of visible page metadata limits the ability to attribute the site to a specific phishing kit or campaign.

Defenders should add ledjor-live.pages.dev to domain blocklists at the DNS resolver level and enforce outbound filtering for the associated IP address 172.66.46.242. Monitoring of Cloudflare name‑server changes is recommended to detect potential re‑hosting. Given the confirmed malicious classification by multiple vendors, network intrusion detection signatures that flag HTTP traffic to this host should be activated. Continuous re‑evaluation is advised as additional intelligence, such as page content or SSL fingerprint, becomes available.