start--en-ledgecom-us-sso[.]pages[.]dev

This domain, start--en-ledgecom-us-sso.pages.dev, was flagged as a credential phishing site targeting single sign-on (SSO) credentials. Registered on February 21, 2026, through Cloudflare, Inc., the domain resolved to IP 172.66.44.216 (AS13335, Cloudflare, Inc., US) and was taken offline by July 25, 2026. Infrastructure analysis reveals the use of Cloudflare nameservers (arely.ns.cloudflare.com, sevki.ns.cloudflare.com), HSTS, and HTTP/3, alongside an SSL certificate issued by Google Trust Services (WE1). The HTTP status returned a 403 Forbidden response at the time of assessment, and the page title explicitly stated 'Suspected phishing site | Cloudflare,' indicating prior detection by the hosting provider.

Detection metrics show limited but consistent flagging: 12 of 93 security vendors on VirusTotal marked the domain as malicious, and it appeared on one security blocklist (PhishDestroy). Trust scores from Gridinsoft and Scamadviser were both 0/100 and 1/100, respectively, reinforcing its classification as high-risk. The scam type is confirmed as credential phishing, though the exact brand or SSO provider being impersonated is not specified in available data. No evidence of a phishing kit or additional infrastructure (e.g., redirect chains, C2 domains) was provided.

Defenders should treat this domain as a confirmed phishing threat, particularly for SSO credential harvesting. While the domain is offline, retrospective analysis of logs for connections to 172.66.44.216 or DNS queries for start--en-ledgecom-us-sso.pages.dev between February 21 and July 25, 2026, is recommended. Blocklisting the domain and IP at perimeter security controls (firewalls, DNS filters, email gateways) is advised to prevent potential re-emergence. No further action is required for systems that did not interact with the domain during its active period.