led-ger-live-eig[.]pages[.]dev

Analysis indicates that the subdomain led-ger-live-eig.pages.dev is currently active and being leveraged in a generic phishing campaign. The domain is hosted on Cloudflare’s infrastructure (registered through Cloudflare, Inc.) and resolves to the IP address 172.66.44.156, which is owned by Cloudflare. Authoritative DNS records list johnathan.ns.cloudflare.com and sloan.ns.cloudflare.com as the nameservers. The domain has been added to at least one public blocklist and is flagged by the PhishDestroy takedown service.

VirusTotal reports that 13 of 91 scanned security vendors have classified the domain as malicious, providing additional corroboration of its threat status. No public Safe Browsing, Open Threat Exchange, SSL certificate, HTTP response code, or page‑title information is presently available, limiting visibility into the exact landing page content. The lack of such data means the precise phishing vector (e.g., credential‑harvesting form or malware downloader) cannot be confirmed at this time.

Defenders should block DNS resolution to 172.66.44.156 and any subdomains under pages.dev that match the pattern led‑ger‑live‑eig.*, enforce outbound filtering to prevent user access, and monitor network logs for TLS connections to Cloudflare’s IP range that originate from internal users. Additional mitigation steps include adding the domain to corporate URL filtering lists, updating endpoint detection rules to incorporate the 13 VirusTotal detections, and reviewing any recent authentication attempts that may involve credentials tied to the targeted organization. Continuous re‑evaluation is advised as further intelligence—such as page content or additional blocklist entries—becomes available.