lddggr-live[.]pages[.]dev

On 2026-07-29 the domain lddggr-live.pages.dev was observed actively serving as a generic phishing infrastructure. The domain is registered through Cloudflare, Inc. and uses Cloudflare’s authoritative name servers dante.ns.cloudflare.com and joselyn.ns.cloudflare.com. DNS resolution points to the IPv4 address 172.66.46.221, which belongs to Cloudflare’s edge network. The domain has been flagged by the PhishDestroy sinkhole, indicating prior detection of malicious activity, and it appears on one external security blocklist. VirusTotal scans returned six positive detections out of ninety‑one submitted security vendors, confirming that multiple independent scanners have identified the host as malicious. The elevated risk rating reflects the combination of confirmed detections, active hosting, and presence on a blocklist.

Available intelligence does not include a page title, SSL certificate details, or observed HTTP response codes, so the exact content served by the site remains undocumented. No additional contextual data such as targeted brands, phishing kits, or campaign identifiers have been released. Consequently, the precise scope of the phishing campaign—such as the victim population or credential harvesting method—cannot be ascertained from the current dataset.

Defenders should prioritize immediate blocking of the domain lddggr-live.pages.dev at the DNS or firewall level, and also consider filtering outbound connections to the associated IP address 172.66.46.221. Because the domain resides within Cloudflare’s network, downstream mitigation may benefit from applying Cloudflare‑specific threat intelligence feeds that capture the same name server signatures. Continuous monitoring of VirusTotal, PhishDestroy, and other threat‑intel platforms is recommended to capture any changes in detection counts or additional blocklist listings.