login-ledgr-live-io[.]pages[.]dev

Analysis indicates that the subdomain login-ledgr-live-io.pages.dev is actively used in a credential phishing campaign. The domain is hosted on Cloudflare’s Pages platform, registered through Cloudflare, Inc., and resolves to the IPv4 address 172.66.47.200. Authoritative name servers alan.ns.cloudflare.com and teresa.ns.cloudflare.com are configured for the zone, confirming the use of Cloudflare’s DNS infrastructure.

VirusTotal reports that 11 of 91 scanned security vendors have flagged the domain as malicious, providing independent confirmation of its abusive nature. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy filtering service, demonstrating that at least one commercial mitigation platform has incorporated the indicator into its protection set. No public SSL certificate details, HTTP response codes, or page title information are currently available, limiting visibility into the exact content served.

Consequently, the precise phishing landing page design and targeted brand remain unknown. Defenders should add the fully qualified domain name to network‑level deny lists, enforce DNS sink‑hole rules for the associated IP address, and monitor for any outbound connections to the Cloudflare edge nodes that resolve to 172.66.47.200. Continuous re‑evaluation is advised, as additional intelligence such as certificate transparency logs or web‑content analysis may emerge and refine the risk posture.