web-leger-us[.]pages[.]dev

The domain web-leger-us.pages.dev was registered on October 15 2025 via Cloudflare Pages, a service that provides static web hosting under the Cloudflare infrastructure. Since its inception the site has been observed in active malicious use, and as of the reporting date (July 29 2026) it carries an elevated risk rating. Automated analysis on VirusTotal shows that 14 out of 91 security vendors classify the domain as malicious, indicating a consensus among multiple scanning engines that the site is being used for phishing. The domain is also listed on a public phishing blocklist operated by PhishDestroy, which corroborates the detection from VirusTotal and provides an additional source of real‑time mitigation. In addition, the domain appears on one external security blocklist, further confirming that independent threat‑intel feeds have flagged it.

Infrastructure profiling reveals that the domain resolves to Cloudflare’s edge network, but no explicit IP address or autonomous system number has been disclosed in the available intelligence. No TLS certificate details, HTTP response codes, or page‑title metadata have been published, leaving the exact content and delivery mechanisms of the site unverified. Consequently, while the hosting environment is known, the specific phishing payload, target brand, or credential‑capture technique remains uncertain. Defenders should prioritize immediate blocking of web-leger-us.pages.dev at perimeter firewalls, DNS filtering, and endpoint protection suites.

Given its presence on VirusTotal and PhishDestroy, existing threat‑intel feeds can be leveraged to automate the block. Continuous monitoring of Cloudflare‑hosted subdomains is recommended, as the attacker may rotate URLs under the same provider. Organizations should also consider raising user awareness for any unsolicited communications that reference URLs ending in “pages.dev”, especially those that request credential entry.