# support-ledgor-en.pages.dev — MALICIOUS

> support-ledgor-en.pages.dev is a credential-stealing phishing domain registered via Cloudflare that holds a VT score of 16/95. Avoid entering any data here.

## Summary
PhishDestroy identifies support-ledgor-en.pages.dev as an active generic phishing domain designed to harvest user credentials under the guise of a support portal. This domain mimics legitimate service-branded pages to trick visitors into submitting login details, often via embedded forms that exfiltrate data to attacker-controlled endpoints. No specific drainer kit has been correlated to this domain in open-source reporting, suggesting either a bespoke implementation or a rebranded package.    This domain was flagged by 16 of 95 participating VirusTotal engines, carries a Google Trust Services SSL certificate, and resolves to IP 172.66.47.84 through Cloudflare, Inc. registration. The .pages.dev suffix indicates deployment on Cloudflare Pages, a platform frequently exploited for rapid phishing site hosting due to its free tier and fast global propagation. While creation date and exact blocklist counts are not publicly disclosed, the combination of low VT detection coverage, trusted certificate issuer, and IP reputation indicates a moderately evasive operation designed to bypass initial screening.    The domain remains active and is currently unblocked by major browsers and security services, though intermittent takedowns may occur. Immediate action is recommended: block 172.66.47.84 and support-ledgor-en.pages.dev at network and endpoint levels. Users who recently entered credentials should rotate passwords immediately and enable MFA on all related accounts. Remaining risk is elevated due to persistent availability and potential for continued credential theft. Monitor threat intelligence feeds for IP or domain remediation updates.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.84

## Detection Status
- VirusTotal: 16 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/cfcfa494-bc1c-421e-8f1e-dfc496d2962f
- PhishDestroy: https://phishdestroy.io/domain/support-ledgor-en.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/support-ledgor-en.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/support-ledgor-en.pages.dev/
Last updated: 2026-03-22