com-start-ldgor[.]pages[.]dev

PhishDestroy identifies com-start-ldgor.pages.dev as an active generic phishing domain designed for credential theft rather than brand impersonation or crypto draining. The site operates under Cloudflare Pages, leveraging Google Trust Services SSL certificates to appear legitimate to victims. Current forensic analysis suggests the infrastructure is configured to harvest login credentials across multiple services without focusing on a single brand, making it a high-mobility threat capable of evolving targets rapidly.

This domain resolves to IP 172.66.44.61 and is hosted through Cloudflare, Inc., which complicates takedown efforts due to Cloudflare’s widespread legitimate usage. VirusTotal currently shows zero detections from its network of 95 scanning engines, indicating a low initial detection rate despite active malicious behavior. The Google Safe Browsing (GSB) status remains unflagged as of the latest scan, and no third-party blocklist entries have yet been recorded. The domain was created recently enough to avoid outdated reputation, reinforcing the importance of proactive monitoring rather than reliance on historical blacklists.

As of the latest scan, the domain remains active and undetected by most security platforms, posing a moderate but evolving risk to potential victims. Immediate action should be taken by security teams to block this domain at DNS and network levels, while users are advised to avoid submitting credentials to unknown or unverified .pages.dev subdomains. Secondary vectors such as phishing emails or spoofed landing pages may emerge using similar naming patterns. Continued monitoring is required, as Cloudflare’s rapid deployment model allows such domains to persist despite takedown requests. Users can verify safety via PhishDestroy’s lookup tool using seed e86f91.