webs-ledgrstart-us-cdn[.]pages[.]dev

The domain webs-ledgrstart-us-cdn.pages.dev was registered on October 15, 2025 via Cloudflare Pages and currently resolves to the IP address 188.114.97.3. VirusTotal analysis shows that 11 of 91 security vendors have flagged the domain, indicating a consensus among multiple scanners that the site is malicious. Google Safe Browsing classifies the URL as a social engineering threat, which aligns with the reported generic phishing activity.

The domain is listed on at least one external security blocklist and has been actively blocked by the PhishDestroy mitigation service, reinforcing the high‑risk assessment assigned by analysts. The infrastructure is hosted on Cloudflare’s shared Pages platform, a common choice for rapid deployment of fraudulent pages because it provides legitimate TLS certificates and masks the underlying server details. No public SSL/TLS certificate details, HTTP status codes, or page titles have been disclosed, leaving those aspects of the site’s behavior unverified.

Defenders should continue to block the domain at network perimeter devices, DNS resolvers, and endpoint security solutions. Monitoring for any new indicators, such as additional hostnames resolving to the same IP or changes in detection counts, is advised. Organizations that rely on Google Safe Browsing or similar reputation feeds should ensure the domain is included in their block lists to prevent credential harvesting attempts.