ledrr-live-donload[.]pages[.]dev

The domain ledrr-live-donload.pages.dev was observed on 2026-07-29 as an active generic phishing infrastructure. Automated scanning by multiple threat‑intelligence services recorded eight positive detections out of ninety‑one scanners on VirusTotal, indicating that a subset of security products have identified malicious behavior associated with the host. The domain is hosted behind Cloudflare’s DNS service, using the authoritative name servers abdullah.ns.cloudflare.com and lady.ns.cloudflare.com, and was provisioned through Cloudflare, Inc., which is a common platform for fast‑flux and abuse.

DNS resolution points to the IPv4 address 188.114.97.3, a Cloudflare edge node that does not reveal the underlying payload server. The indicator set has been added to at least one public blocklist and is actively blocked by the PhishDestroy mitigation platform. No additional intelligence such as page titles, SSL certificate details, HTTP response codes, or malware sandbox analysis has been published for this host, so the exact phishing landing page content remains unknown.

Defenders should prioritize containment of traffic to this domain. Recommended actions include adding ledrr-live-donload.pages.dev and its resolved IP 188.114.97.3 to DNS‑sinkhole or firewall deny lists, monitoring outbound connections to Cloudflare edge nodes for anomalous patterns, and reviewing any internal logs for recent accesses to the domain. Continuous re‑evaluation is advised, as further analysis may reveal additional indicators such as TLS fingerprints or malicious payloads that could refine detection rules.