en-us-ledge[.]pages[.]dev

The domain en-us-ledge.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline. The site presented the page title “Suspected phishing site | Cloudflare,” indicating a credential phishing attempt targeting the Cloudflare brand. Technical inspection shows the domain resolves to IP address 172.66.44.205, which belongs to AS13335 Cloudflare, Inc. in the United States and is protected by Cloudflare’s own edge services. The TLS certificate was issued by Google Trust Services under the WE1 identifier, confirming the use of a legitimate certificate chain.

HTTP responses return a 403 status code, and the server advertises HSTS, Cloudflare, and HTTP/3, consistent with standard Cloudflare infrastructure. Reputation checks are uniformly negative: Scamadviser assigns a trust score of 1 / 100, Gridinsoft reports a score of 0 / 100, and the domain appears on a single security blocklist. VirusTotal analysis records three detections out of ninety‑three scanned security vendors, reinforcing the malicious classification. The domain is listed as blocked by the PhishDestroy feed.

Nameserver records list graham.ns.cloudflare.com and love.ns.cloudflare.com, further confirming Cloudflare‑hosted DNS. While the site is offline, the observed infrastructure—Cloudflare‑hosted IP, legitimate SSL, and low reputation scores—suggests the actor leveraged trusted hosting to increase credibility. Defenders should continue to block the domain and its associated IP, monitor the nameservers for any re‑activation, and incorporate the three VirusTotal detections into threat‑intel feeds. Additional scrutiny of traffic to the IP address and correlation with other Cloudflare‑based phishing artifacts is recommended to identify potential campaign reuse.