tread-ldgor-live[.]pages[.]dev

Analysis of the domain tread-ldgor-live.pages.dev shows that it was registered on March 27 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network, resolving to the IP address 188.114.97.3. The authoritative name servers are johnny.ns.cloudflare.com and kim.ns.cloudflare.com, both standard Cloudflare resolvers. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service, indicating that at least one defensive feed has classified it as malicious.

VirusTotal records confirm that the domain was submitted for scanning to 91 antivirus and URL‑reputation engines; at the time of the query none of the engines returned a detection. While the absence of detections does not guarantee benign behavior, the combination of recent creation, Cloudflare‑based hosting, inclusion on a blocklist, and active blocking by PhishDestroy aligns with typical infrastructure used for generic phishing campaigns. No public information is available regarding the page title, SSL certificate details, or HTTP response codes, leaving the content of the site unverified.

Defenders should continue to block the domain at perimeter filters, update URL‑reputation feeds, and monitor traffic to the associated IP address for any anomalous patterns. Additional investigation, such as retrieving the landing page and inspecting request parameters, is recommended to confirm the phishing intent and to identify any credential‑harvesting endpoints that may be in use.