ing-ledgeir[.]pages[.]dev

This domain, ing-ledgeir.pages.dev, operates as a credential theft site designed to impersonate legitimate financial institutions. Analysis indicates the infrastructure was constructed to harvest usernames, passwords, and multi-factor authentication codes from victims under the guise of a trusted banking or investment portal. The use of financial terminology in URL paths and page content suggests targeting of retail banking customers, with potential secondary objectives including account takeover or unauthorized fund transfers. The domain exhibits no legitimate business purpose and lacks affiliation with any verified financial entity. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 03, 2026, with an anomalous future creation date that may indicate registry manipulation or misconfiguration. It resolves to the IP address 172.66.45.36, a Cloudflare proxy endpoint commonly used to conceal origin servers. The domain appears on one security blocklist and is flagged by 5 of 95 security vendors on VirusTotal, including detections for credential phishing and brand impersonation. The SSL certificate, issued by Google Trust Services, provides no assurance of legitimacy due to the automated nature of Cloudflare's certificate issuance process. The page title, 'Suspected phishing site | Cloudflare,' suggests the hosting provider has already identified and flagged the content. Users who visited ing-ledgeir.pages.dev should immediately revoke any active sessions on financial accounts accessed from the same device or network. Reset passwords using a separate, trusted device, and enable multi-factor authentication if not already active. Monitor account statements for unauthorized transactions and report suspicious activity to the affected financial institution. Clear browser cache, cookies, and saved credentials, as the site may have deployed persistent tracking mechanisms. Network administrators should block the domain and associated IP address (172.66.45.36) at the perimeter, and review logs for connections to this infrastructure. The anomalous creation date warrants additional scrutiny of registry records for potential fraud indicators.