liv-leedger[.]pages[.]dev

Analysis of liv-leedger.pages.dev as of July 29, 2026 reveals infrastructure consistent with active phishing operations. The domain is registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3, a Cloudflare edge node. Nameservers alla.ns.cloudflare.com and reese.ns.cloudflare.com further confirm Cloudflare hosting, a platform frequently leveraged by threat actors for its free, anonymous, and ephemeral hosting capabilities. The domain appears on one security blocklist and is flagged by 9 of 91 security vendors on VirusTotal, indicating detection by multiple anti-phishing engines.

PhishDestroy has blocked access to this domain, providing additional confirmation of its malicious classification. No specific brand impersonation or scam category is identified in the available data, and the exact content of the site remains unanalyzed. However, the combination of Cloudflare Pages hosting, detection by security vendors, and blocklist inclusion strongly suggests this is a generic phishing endpoint rather than a benign or misconfigured resource. The use of Cloudflare's infrastructure may complicate takedown efforts and allow rapid redeployment under new subdomains.

Defenders should treat this domain as an active threat. Network-level blocking of 188.114.96.3 is not recommended due to potential collateral impact on legitimate Cloudflare-hosted sites, but the domain itself should be blocked at DNS, proxy, and endpoint security layers. Security teams are advised to monitor for additional subdomains under pages.dev that exhibit similar detection patterns, as this infrastructure is commonly reused for phishing campaigns. Further analysis of HTTP headers, SSL certificates, and page content may provide additional indicators of compromise or campaign attribution.