io-ldger-usa-en[.]pages[.]dev

Analysis on 29 July 2026 indicates that the domain io-ldger-usa-en.pages.dev is actively serving a generic phishing infrastructure. The domain is registered through Cloudflare, Inc. and resolves to the IP address 172.66.44.93, which belongs to Cloudflare’s edge network. Authoritative nameservers listed are elsa.ns.cloudflare.com and jobs.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service.

Google Safe Browsing classifies the site under social engineering, and the domain appears on at least one public security blocklist. PhishDestroy has recorded the domain as blocked, reinforcing the view that it is being used for malicious campaigns. VirusTotal shows that the domain was examined by 91 scanning engines, none of which produced a detection at the time of analysis; however, the absence of detections does not guarantee the domain is benign.

No additional intelligence such as SSL certificate details, HTTP response codes, page titles, or brand targeting has been published, leaving the exact payload and victim‑facing content unknown. Defenders should treat the domain as hostile, enforce network‑level blocking, add the IP and hostnames to intrusion‑prevention and DNS filtering rules, and monitor for any future changes in reputation or observed traffic. Continuous re‑evaluation is advised, as the lack of visible content may change if the attackers modify the site or deploy new phishing kits.