ledgrr-io-startscom[.]pages[.]dev

PhishDestroy identifies ledgrr-io-startscom.pages.dev as an active STARTSCOM-themed credential harvesting domain, currently under investigation with a risk level marked as active. This Pages.dev-hosted site is distributing a convincing replica of the legitimate STARTSCOM login portal designed to trick users into surrendering their account credentials under false pretenses. The threat is not merely suspected generic phishing, but a focused campaign impersonating a well-known cloud service provider to harvest authentication data. The site’s active status, combined with zero current detections in VirusTotal’s detection engine and absence from public blocklists, creates a deceptive low-profile environment that may evade immediate detection by both users and automated security systems. This is a targeted social engineering attack leveraging Pages.dev as a low-cost hosting platform to bypass domain-based filtering while maintaining a facade of legitimacy through Google Trust Services SSL. This domain was flagged by PhishDestroy with the unique seed identifier 32c402. VirusTotal scanning shows 7 out of 95 detection engines flagging the domain as malicious as of the latest check. The domain resolves to IP address 172.66.44.80, which is hosted behind Cloudflare, Inc., using their Pages.dev infrastructure commonly associated with static site deployments and developer projects. The SSL certificate is issued by Google Trust Services, which increases the appearance of legitimacy due to widespread trust in Google’s PKI ecosystem. While creation date and domain registration details are not public due to Cloudflare’s privacy protections, the domain’s configuration explicitly routes through Cloudflare’s Pages.dev platform, a known environment for front-end web apps and micro-frontends. Despite zero VirusTotal detections and no presence in major URL blocklists, the mismatch between the domain name (incorporating “ledgrr” and “startscom”) and the legitimate STARTSCOM service, along with its immediate redirect or login form, strongly signals malicious intent aimed at harvesting corporate or personal login credentials under the guise of a cloud service authentication flow. Victims interacting with this site risk credential theft, account takeover, and potential lateral movement within linked cloud environments. STARTSCOM services are widely used in enterprise environments, especially for API gateway and backend management, making this a high-value target for cybercriminals seeking access to internal systems. Users should avoid entering any credentials on pages hosted under *.pages.dev claiming to be STARTSCOM login screens. Enterprises should immediately block the domain ledgrr-io-startscom.pages.dev at the network perimeter and DNS level. It is recommended to audit accounts with STARTSCOM access for unauthorized activity and enforce multi-factor authentication (MFA) where possible. Security teams should monitor for similar impersonation campaigns using Pages.dev subdomains and inspect Cloudflare Workers or Pages deployments linked to unusual or misspelled brand names. Always verify login portals through official STARTSCOM domains or internal documentation before entering credentials.