led-ger-com-start-app-dnn[.]pages[.]dev

The domain led-ger-com-start-app-dnn.pages.dev is currently active and classified as a generic phishing site with an elevated risk rating. Infrastructure analysis shows that the domain resolves to the IP address 172.66.47.103 and is hosted behind Cloudflare’s network, as indicated by the authoritative nameservers cruz.ns.cloudflare.com and lynn.ns.cloudflare.com. Registration details confirm that the domain was provisioned through Cloudflare, Inc., a common registrar for fast‑deployment threat actors.

Threat‑intel feeds list the domain on a single security blocklist, and it is actively blocked by the PhishDestroy filtering service. VirusTotal scans have recorded detections from 10 of 91 security vendors, providing multi‑engine corroboration of malicious intent. While the available data confirm the domain’s malicious disposition, no public page title or content snapshot has been released, leaving the exact phishing lure—such as the targeted brand or credential‑capture mechanism—undetermined.

Defenders should immediately add led-ger-com-start-app-dnn.pages.dev to outbound deny lists, enforce DNS‑level blocking, and monitor traffic to its hosting IP (172.66.47.103) for anomalous connections. Continuous re‑scanning with multi‑engine services is advised to capture any changes in payload or hosting configuration. Integration with threat‑intelligence platforms that ingest blocklist entries and PhishDestroy alerts will improve detection precision and reduce exposure to this active phishing infrastructure.