# support-ledgor-io.pages.dev — MALICIOUS

> support-ledgor-io.pages.dev is a PayPal phishing page hosted on Cloudflare Pages. 15 security vendors flagged this domain on VirusTotal. Check the full report.

## Summary
PhishDestroy identifies support-ledgor-io.pages.dev as an active PayPal credential-harvesting campaign. The site impersonates PayPal’s support portal to steal login details and financial data. Visitors are prompted to enter their PayPal credentials on a fake login form that captures keystrokes and exfiltrates them to attacker-controlled servers.

This domain was flagged by 15 of 95 VirusTotal security vendors and resolves to IP address 188.114.96.3. Cloudflare Pages registered the domain, and it is protected by a Google Trust Services SSL certificate, giving it a deceptive appearance of legitimacy. The combination of a Cloudflare front-end, valid SSL, and PayPal branding is a common tactic to bypass browser security warnings and trick users into entering sensitive information.

If you visited support-ledgor-io.pages.dev, assume your PayPal credentials may have been compromised. Immediately change your PayPal password using a known-safe device and enable two-factor authentication. Review recent transactions for unauthorized activity and report any fraudulent charges to PayPal. Clear browser cache and cookies related to this domain, and consider running a full antivirus scan. If you reused the same password elsewhere, change it on those sites as well. Forward any suspicious emails or links to PayPal’s official reporting channel for further investigation.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 15 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/20af5e6d-a106-49d3-b95f-3c04171a5634
- PhishDestroy: https://phishdestroy.io/domain/support-ledgor-io.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/support-ledgor-io.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/support-ledgor-io.pages.dev/
Last updated: 2026-03-24