logon-ledggr-live[.]pages[.]dev

The domain logon-ledggr-live.pages.dev is currently active and has been identified as a generic phishing site. VirusTotal reports that nine out of ninety‑one scanning engines flag the domain as malicious, indicating a moderate level of detection consensus among security products. The domain appears on a single external blocklist and is listed by the PhishDestroy mitigation service, confirming that multiple defensive feeds have observed malicious activity associated with it. DNS resolution points to the IP address 172.66.47.61, which is owned by Cloudflare, Inc. The authoritative nameservers are marek.ns.cloudflare.com and molly.ns.cloudflare.com, both operated by Cloudflare.

Registration was performed through Cloudflare, Inc., a common registrar for fast‑flux and abuse‑resilient infrastructures, further supporting the likelihood of intentional obfuscation. No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange entries, SSL certificate details, HTTP response codes, or page‑title metadata is presently available for this host, leaving those aspects of the site unverified. Defenders should block or sinkhole the domain at the network perimeter, add the associated IP address to deny lists, and ensure that endpoint protection solutions incorporate the VirusTotal detection count as an indicator of compromise. Continuous monitoring of the Cloudflare nameserver set and any future VirusTotal or blocklist updates is recommended to capture changes in detection posture.

Because the domain is hosted on a shared Cloudflare edge, legitimate services may also use the same IP range; thus, rule creation should be scoped to the fully qualified domain name to avoid collateral disruption. Organizations that employ email filtering should treat any messages containing URLs that resolve to this domain as malicious and quarantine them.