ledzr-io-start[.]pages[.]dev

ledzr-io-start.pages.dev was observed on July 29 2026 as part of an ongoing generic phishing investigation. The domain is hosted behind Cloudflare, Inc., with registration details indicating the use of Cloudflare’s DNS service. Authoritative nameservers are cameron.ns.cloudflare.com and sima.ns.cloudflare.com, and the domain resolves to the IPv4 address 188.114.96.3.

The address is currently listed on a single security blocklist and has been actively blocked by the PhishDestroy feed, which suggests that the domain is being used to deliver phishing content. VirusTotal records show that the domain was scanned by 91 independent vendors; none of the scanners raised a detection at the time of analysis. The absence of detections does not constitute evidence of benign behavior, and the lack of additional telemetry limits the ability to assess the payload or victim interaction.

No SSL/TLS certificate details, HTTP response codes, page titles, or Safe Browsing verdicts are available in the current intelligence set, leaving the exact nature of the hosted content uncertain. Defenders should treat the domain as malicious until further verification, incorporate the IP address 188.114.96.3 and the domain name into network‑level deny lists, and continue to monitor for any new indicators such as updated blocklist entries, changes in DNS resolution, or emergent detection signatures. Ongoing collection of HTTP response data and content analysis is recommended to refine the threat profile and to support possible takedown actions.