live-en-ledgger[.]pages[.]dev

PhishDestroy identifies an active phishing campaign using the domain live-en-ledgger.pages.dev, designed to impersonate Google Ledger services for credential theft. This domain leverages Cloudflare Pages to host a deceptive login portal, tricking users into entering sensitive account credentials under the guise of managing cryptocurrency assets. The campaign targets victims with misleading subdomains and HTTPS encryption via Google Trust Services, increasing the appearance of legitimacy while facilitating unauthorized access to user accounts. Analysis of this domain reveals it resolves to IP address 188.114.97.3, a known hosting infrastructure often abused for phishing operations.

This domain was flagged as part of a newly observed Google Ledger-themed phishing operation, with current threat intelligence indicating zero detections across 95 VirusTotal scanners as of the latest scan. Registered through Cloudflare, Inc., this domain’s infrastructure is deliberately obscured to evade early detection while maintaining operational resilience. Preliminary blocklist assessments show no prior associations in public threat feeds, suggesting this is a fresh deployment aimed at capitalizing on the trust associated with Google’s brand. The use of Cloudflare Pages and Google-issued SSL certificates demonstrates adversary sophistication in bypassing traditional security filters.

Users who visited live-en-ledgger.pages.dev should immediately check their Google Ledger account for unauthorized activity and revoke any sessions originating from this domain. Clear browser cache and cookies related to Google Ledger sessions, and consider enabling two-factor authentication if not already active. Report the domain to your security team or through your organization’s phishing reporting channel. Avoid interacting with this domain further, as it poses a direct risk to cryptocurrency assets and personal data. Monitor financial accounts closely for suspicious transactions and consider resetting passwords for any accounts accessed after visiting this site. If you entered credentials, change them immediately and enable account recovery options to prevent further compromise.