sso-ladger-co-start[.]pages[.]dev

The domain sso-ladger-co-start.pages.dev is currently listed on one public security blocklist and has been actively blocked by the PhishDestroy feed. DNS resolution points to the IPv4 address 188.114.96.3, and the authoritative name servers are ivy.ns.cloudflare.com and keanu.ns.cloudflare.com, indicating that the hosting infrastructure is provided through Cloudflare, Inc. The domain registration is also listed as being performed via Cloudflare, which is consistent with the use of Cloudflare’s DNS services. A recent VirusTotal scan submitted the URL to 91 antivirus and threat‑intelligence engines; at the time of analysis none of those engines reported a detection, though the absence of flags does not constitute assurance of benign behavior.

The domain is classified as a generic phishing campaign and its status is marked as active, with the risk level noted as under investigation. No additional metadata such as page title, brand targeting, or specific phishing kit has been released, leaving the exact content and victim lure unknown. Given the limited detection footprint—only one blocklist entry—and the lack of public vendor alerts, defenders should treat the domain as suspicious and proactively add it to DNS‑based deny lists, web‑gateway block rules, and endpoint URL filtering policies.

Continuous monitoring of traffic to 188.114.96.3 and periodic re‑scanning of the domain are recommended to capture any future changes in behavior or detection status. Organizations employing zero‑trust networking should ensure that any authentication flows that could be redirected to this domain are halted, and security teams should log any connection attempts for forensic correlation.