c6354cb7[.]lehd-8fh4[.]pages[.]dev

On 24 July 2026, the domain c6354cb7.lehd-8fh4.pages.dev was observed as taken offline. The site returned an HTTP 403 response and the page title reported by the crawler was "Suspected phishing site | Cloudflare". DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The hosting infrastructure advertises HSTS and HTTP/3, and the TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid public‑trusted certificate.

VirusTotal recorded 7 detections out of 95 scanning engines, confirming that multiple security products consider the domain malicious. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. Registration details show the domain was provisioned through Cloudflare, Inc., with no separate authoritative nameserver information returned.

The available evidence points to a credential‑phishing campaign, though the specific target or lure employed on the page is not disclosed in the current data set. Uncertainty remains regarding the content that was served before the site was taken offline, as no forensic capture of the landing page is available. Defenders should continue to block the IP 188.114.96.3 and any subdomains under pages.dev that resolve to the same address, enforce URL filtering based on the observed domain, and monitor for re‑use of the Cloudflare‑hosted infrastructure in future phishing attempts. Additional threat‑intel sources should be queried for any related indicators of compromise that may share the same hosting or certificate fingerprint.