ledgar-live-guide[.]pages[.]dev

PhishDestroy identifies ledgar-live-guide.pages.dev as an active credential harvesting domain under investigation for generic phishing activities. This domain poses a direct threat to users who may input sensitive login credentials or financial details, believing the site to be a legitimate financial guide or dashboard. The risk level remains under_investigation due to pending behavioral analysis, but the threat type is confirmed as generic_phishing targeting unsuspecting visitors.

This domain was flagged with 0 detections out of 95 on VirusTotal, indicating it has not yet been widely recognized as malicious by antivirus engines. It is registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3. The SSL certificate is issued by Google Trust Services, which may lend an air of legitimacy but does not guarantee safety. The domain operates under the .pages.dev TLD, a free subdomain service provided by Cloudflare, often abused by threat actors for short-lived phishing campaigns. The seed identifier 687ff5 confirms this as a tracked instance in the PhishDestroy database.

Users should avoid entering any personal or financial information on ledgar-live-guide.pages.dev. Immediately close browsers and clear cookies if accidentally accessed. Report the domain to your organization’s security team or via PhishDestroy’s submission portal. Network administrators should block the IP 188.114.96.3 and domain at the firewall level. Given the use of Cloudflare’s infrastructure, traditional IP-based blocking may be less effective; instead, rely on DNS filtering or endpoint protection to detect and prevent access. Monitor for any unusual login attempts or data exfiltration patterns associated with this domain.