get-ldger-io[.]pages[.]dev

On 2026-07-29 the domain get-ldger-io.pages.dev was observed as an active generic phishing infrastructure with an elevated risk rating. VirusTotal records show that six out of ninety‑one scanners flag the domain as malicious, indicating a moderate level of consensus among anti‑malware engines. The domain resolves to the IPv4 address 172.66.44.52, which is owned by Cloudflare’s network and is served from the same infrastructure that hosts many legitimate sites, complicating straightforward network‑level blocking. DNS queries return two Cloudflare authoritative name servers, anastasia.ns.cloudflare.com and frank.ns.cloudflare.com, confirming that the registrar used was Cloudflare, Inc. The domain appears on a single external security blocklist and is actively listed by the PhishDestroy sinkhole, demonstrating that at least one dedicated phishing mitigation service has already taken action against it.

No public page title, brand target, or kit information is available in the current intelligence set, so the specific victim profile and the exact credential‑harvesting page layout remain unknown. The lack of visible page content means that automated content‑analysis tools cannot yet confirm whether the site mimics a particular service, and the limited blocklist presence suggests that broader community awareness may still be developing.

Defenders should prioritize adding get-ldger-io.pages.dev to DNS‑based deny lists and web‑proxy filtering rules, especially in environments where generic phishing attempts are common. Continuous monitoring of the IP address 172.66.44.52 is advised, as the host may serve additional malicious domains in the future. Correlation with endpoint telemetry that reports the six VirusTotal detections can help surface compromised hosts. Finally, organizations should maintain visibility into Cloudflare‑hosted domains, as the shared infrastructure can obscure attribution and increase the likelihood of collateral impact.