ledxerlive[.]pages[.]dev

The domain ledxerlive.pages.dev was observed on July 29, 2026 as an active generic phishing infrastructure. Registration details show the domain is hosted through Cloudflare, Inc., using the authoritative nameservers sunny.ns.cloudflare.com and valentin.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.97.3. The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy service, indicating that at least one reputable anti‑phishing feed has flagged it. The risk level is elevated, reflecting the combination of active operation and multiple vendor detections.

VirusTotal analysis recorded eight positive detections out of ninety‑one submitted security engines, confirming that multiple independent scanners have identified malicious behavior associated with the domain. The elevated risk rating reflects the combination of active status, blocklist presence, and multi‑vendor detections.

No additional contextual data such as SSL certificate details, HTTP response codes, page title, or brand targeting were available at the time of analysis, so the exact payload or credential‑stealing mechanism remains unknown. The lack of public intelligence on the hosted content prevents a deeper attribution of the campaign’s objectives beyond the generic phishing classification.

Defenders should add ledxerlive.pages.dev to local deny lists, enforce DNS‑based blocking, and monitor outbound traffic for connections to 188.114.97.3. Correlation of endpoint alerts that reference the domain or its IP with the eight VirusTotal detections can help prioritize remediation. Continuous re‑evaluation is recommended, as further intelligence such as page content or additional blocklist listings may emerge. The use of Cloudflare’s edge network may obscure the true origin server, complicating takedown efforts.