leedger-live-desktop-web[.]pages[.]dev

The domain leedger-live-desktop-web.pages.dev was observed actively serving a generic phishing campaign as of the report date, July 29 2026. Infrastructure analysis shows the domain is hosted on Cloudflare’s network, using the authoritative name servers perla.ns.cloudflare.com and viddy.ns.cloudflare.com. DNS resolution points to the IP address 172.66.44.247, which belongs to Cloudflare’s edge infrastructure. The registration was performed through Cloudflare, Inc., indicating the use of a privacy‑preserving registrar that masks end‑user details.

The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, suggesting that at least one downstream security product has already flagged the host as malicious. VirusTotal scans returned nine positive detections out of ninety‑one submitted scanners, reinforcing the suspicion that the site hosts malicious content. No additional intelligence such as page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts is available, leaving the exact content and the targeted brand(s) unverified.

Consequently, the current evidence base consists solely of DNS, hosting, and third‑party detection signals. Defenders should prioritize adding the domain and its resolved IP address to network deny lists, monitor for outbound connections to the Cloudflare edge node, and employ threat‑intel feeds that include PhishDestroy to capture future variants. Continuous re‑analysis of the URL, especially after any change in page content or SSL configuration, is recommended to refine detection rules and to confirm the phishing payload if it becomes observable.