public-starts-en-ledgecom[.]pages[.]dev

Analysis as of July 29, 2026 indicates that the domain public-starts-en-ledgecom.pages.dev is actively used for generic phishing. The domain is hosted on Cloudflare’s network, using the nameservers elsa.ns.cloudflare.com and jobs.ns.cloudflare.com, and resolves to the IPv4 address 188.114.96.3. Registration is performed through Cloudflare, Inc., which is consistent with the use of Cloudflare’s DNS and edge services for fast content delivery. The domain appears on a single security blocklist and has been flagged by the PhishDestroy sinkhole, confirming its involvement in malicious campaigns.

VirusTotal scans have recorded detections from seven of ninety‑one AV engines, providing independent confirmation of malicious activity. No additional public indicators such as Safe Browsing entries, OTX pulses, SSL certificate details, or HTTP response codes are presently available. The page title and content have not been publicly disclosed, leaving the exact visual or credential‑harvesting tactics unknown.

Defenders should treat any traffic to this domain as hostile, block the domain at DNS and proxy layers, and monitor the associated IP address for anomalous connections. Because the infrastructure leverages Cloudflare, standard IP‑based blocking may affect unrelated legitimate services hosted on the same network; therefore, URL‑level filtering is recommended where feasible. Continuous re‑evaluation of threat intelligence feeds is advised to capture any emerging detections or changes in the domain’s status.