ledestart[.]gl

Analysis of the domain ledestart.gl indicates it was associated with an Airdrop Scam phishing campaign, as classified by available threat intelligence. The domain resolved to the IP address 188.114.97.3, which is part of AS13335 (Cloudflare, Inc.) and geolocated in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (amit.ns.cloudflare.com and lisa.ns.cloudflare.com), a common pattern observed in phishing operations leveraging Cloudflare services for obfuscation and resilience. The domain was registered through NiceNIC International Group Co., Limited on November 26, 2025, and exhibited no SSL certificate at the time of assessment. Security vendor detections were limited but indicative of malicious intent: three of ninety-five security vendors on VirusTotal flagged the domain as suspicious.

Additionally, the domain appeared on one security blocklist, specifically PhishDestroy. The Gridinsoft trust score of 0/100 further corroborates its classification as high-risk. At the time of this report, the domain returned an HTTP 522 error (Connection timed out), suggesting it has been taken offline or is no longer actively serving content. However, the underlying infrastructure may still pose a residual threat if repurposed.

Defenders are advised to monitor for any reactivation of this domain or similar registrations under the same registrar or hosting provider. Given the use of Cloudflare services, additional scrutiny of domains utilizing the same nameservers or IP ranges may be warranted. While the exact content of the phishing page remains unanalyzed, the classification as an Airdrop Scam suggests it likely targeted cryptocurrency users with fraudulent token distribution schemes. No further brand-specific details are available from the provided intelligence.