ledegercom-start-us[.]pages[.]dev

Analysis of ledegercom-start-us.pages.dev shows a clear pattern of malicious infrastructure. The domain is delegated to Cloudflare’s authoritative name servers kay.ns.cloudflare.com and phil.ns.cloudflare.com and resolves to the IP address 172.66.45.2, a host that is part of Cloudflare’s edge network. Registration was performed through Cloudflare, Inc., indicating the use of a privacy‑preserving registrar that obscures the true registrant. The domain currently appears on one public security blocklist and has been explicitly blocked by the PhishDestroy service, confirming active mitigation by at least one anti‑phishing vendor.

VirusTotal analysis reports that 12 of 91 scanning engines have flagged the domain as malicious, providing independent corroboration of its threat status. No additional data such as Safe Browsing verdicts, Open Threat Exchange (OTX) entries, SSL certificate details, or HTTP response codes are available in the current intelligence set, and the page title has not been disclosed, leaving the exact content of the site unverified. However, the combination of Cloudflare‑based hosting, a dedicated blocklist entry, and multiple vendor detections is sufficient to classify the site as a confirmed phishing platform targeting unsuspecting users.

Defenders should immediately add ledegercom-start-us.pages.dev to URL and DNS blocklists, enforce network‑level filtering of traffic to 172.66.45.2, and monitor any outbound connections that may originate from compromised internal hosts. Continuous re‑scanning with VirusTotal and other multi‑engine services is recommended to capture any evolution of the payload. Organizations that rely on Cloudflare edge services should consider tightening their outbound filtering policies to include this specific domain, as its hosting profile suggests it could be leveraged for rapid content changes without altering the underlying IP address.