ldegrr-live[.]pages[.]dev

Analysis of ldegrr-live.pages.dev indicates an active phishing domain registered through Cloudflare, Inc. as of July 29, 2026. The domain resolves to IP address 172.66.44.154 and uses Cloudflare nameservers dante.ns.cloudflare.com and joselyn.ns.cloudflare.com. Detection data from VirusTotal shows that 10 of 91 security vendors flag the domain as malicious, while it appears on one security blocklist and is specifically blocked by PhishDestroy. The threat classification is generic phishing with an elevated risk level, though the exact content or targeted brand has not been confirmed through available evidence.

Infrastructure analysis reveals the domain is hosted on Cloudflare's content delivery network, a common pattern for both legitimate and malicious sites due to the provider's privacy and security features. The use of Cloudflare Pages (.pages.dev) subdomains may complicate takedown efforts, as these are dynamically generated and managed through Cloudflare's platform. No additional details regarding the phishing kit, HTTP response codes, or SSL certificate anomalies are present in the current intelligence. Defenders should treat this domain as confirmed malicious based on vendor detections and blocklist inclusion.

Network-level blocking of 172.66.44.154 and monitoring of other .pages.dev subdomains on the same nameservers may help mitigate related threats. Further investigation into the domain's content is recommended to determine the specific phishing campaign, though no visual or brand-specific details are currently available. The domain remains active as of the report date, and security teams should prioritize its inclusion in detection and prevention measures.