log-ledgr-learn[.]pages[.]dev

log-ledgr-learn.pages.dev is observed resolving to the IPv4 address 172.66.44.231. The domain is delegated to Cloudflare’s DNS infrastructure, using the authoritative name servers candy.ns.cloudflare.com and ishaan.ns.cloudflare.com. Registration details indicate the registrar as Cloudflare, Inc., which is consistent with the use of Cloudflare’s edge services for hosting. VirusTotal records show the domain has been scanned by 91 anti‑malware vendors; none of the vendors reported a detection at the time of analysis. While the absence of detections does not constitute a safety assurance, it demonstrates that the sample has not yet triggered automated signatures.

The domain is currently listed on a single security blocklist and is actively blocked by the PhishDestroy mitigation service. No additional public blocklists or reputation feeds have flagged the domain. The available evidence points to a typical phishing infrastructure: a Cloudflare‑provided front‑end, a single IP address, and minimal detection history. The lack of publicly available page title, SSL certificate details, or HTTP response codes limits the ability to confirm the exact payload or targeted brand.

Consequently, the precise content of the site remains unverified, and the scope of the phishing campaign cannot be fully quantified. Defenders should consider adding 172.66.44.231 and the domain log-ledgr-learn.pages.dev to network‑level deny lists, enforce DNS filtering that includes the observed blocklist, and monitor for any future detections from additional vendors. Continuous re‑scanning through VirusTotal or similar services is recommended to capture any changes in malicious behavior. Logging of outbound connections to the identified IP can aid in incident response and attribution efforts.