start-ledzr-us[.]pages[.]dev

On July 29, 2026, the domain start-ledzr-us.pages.dev was observed in active phishing infrastructure. The domain resolves to the IP address 172.66.44.60, which is hosted by Cloudflare, Inc., as indicated by the registrar information and the authoritative nameservers brynne.ns.cloudflare.com and garret.ns.cloudflare.com. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, demonstrating that at least one external mitigation platform has identified it as malicious.

VirusTotal analysis shows that 14 of 91 antivirus and URL‑reputation engines flagged the domain, providing independent corroboration of its suspicious nature. No additional public intelligence such as Safe Browsing, Open Threat Exchange, SSL certificate details, HTTP response codes, or page title has been released, leaving the exact phishing campaign or targeted brand undefined. The current evidence set therefore confirms that the domain is being leveraged for generic phishing, but the payload, victim profile, and operational timeline remain uncertain.

Defenders should add the domain to local blocklists, monitor DNS queries for the 172.66.44.60 address, and enforce outbound filtering to prevent connections to Cloudflare‑hosted domains that are not explicitly trusted. Continuous re‑scanning on VirusTotal and observation of any new blocklist listings are recommended to track potential escalation.