ledgeer-live-get[.]pages[.]dev

The domain ledgeer-live-get.pages.dev is presently taken offline, as indicated by a HTTP 403 response and a status flag of "offline" in the intelligence feed. Infrastructure analysis shows the domain resolves to the Cloudflare edge address 172.66.47.70, which is registered to Cloudflare, Inc. in Canada. The authoritative nameservers are keira.ns.cloudflare.com and valentin.ns.cloudflare.com, both Cloudflare‑operated, confirming that the domain is hosted behind Cloudflare’s reverse‑proxy service. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, a standard certificate chain for Cloudflare‑proxied sites, and does not itself indicate malicious intent.

The page title returned from the server is "Suspected phishing site | Cloudflare," which aligns with the reported scam type of credential phishing. Gridinsoft’s trust scoring system assigns the domain a zero out of one hundred, reflecting an extremely low reputation. VirusTotal has recorded 12 detections out of 94 scanned engines, providing independent confirmation of malicious activity. The domain was registered on 6 April 2026 through Cloudflare, Inc., and appears on a single security blocklist, specifically PhishDestroy, which has actively blocked it.

While the offline status prevents direct examination of the payload or landing page, the combination of a low trust score, multiple vendor detections, and the presence on a reputable phishing blocklist strongly suggests the domain was used for credential harvesting. Defenders should continue to block the domain at DNS and proxy layers, add the associated IP address 172.66.47.70 to threat‑intel feeds, and monitor for any re‑hosting attempts that may bypass Cloudflare’s protection. Ongoing observation of the domain’s registration details and any future DNS changes is recommended to detect potential repurposing.