access-ledgr-live-io[.]pages[.]dev

The domain access-ledgr-live-io.pages.dev is currently active and has been classified as a generic phishing infrastructure. Registration information shows the domain was provisioned through Cloudflare, Inc., and its authoritative name servers are erin.ns.cloudflare.com and george.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and edge services. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare’s global Anycast network, a common hosting choice for short‑lived malicious sites because it provides rapid deployment and mitigation resistance. VirusTotal analysis reports that eight out of ninety‑one security vendors have flagged the domain as malicious, confirming that multiple independent detection engines have observed suspicious activity associated with it.

The domain is listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing the consensus that the domain is being used for phishing attempts. No additional public intelligence such as Safe Browsing verdicts, OTX pulse references, or page‑title metadata is available at this time. Uncertainty remains regarding the specific payload or credential‑harvesting technique employed, as no content‑level analysis has been published. Likewise, the geographic origin of the operators cannot be inferred from the provided data, and no SSL certificate details or HTTP response codes have been disclosed.

Defenders should therefore treat the domain as a high‑confidence indicator of compromise. Recommended actions include adding the full domain name to outbound and inbound URL filtering rules, enforcing DNS‑level blocking on recursive resolvers, and monitoring for any internal DNS queries to the associated IP address. Continuous re‑evaluation is advised, as the threat actor may relocate the phishing landing page to alternate subdomains or IPs within the same Cloudflare range.