live-ledgelive[.]pages[.]dev

Analysis of live-ledgelive.pages.dev indicates that the domain was provisioned on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presented the page title “Suspected phishing site | Cloudflare” and returned an HTTP 403 status code, suggesting that access is currently denied. The SSL certificate presented by the host is issued by Google Trust Services under the WE1 identifier, confirming the use of a valid TLS chain. Infrastructure fingerprints show the domain is protected by Cloudflare’s edge services, with HSTS and HTTP/3 enabled, and authoritative nameservers listed as celeste.ns.cloudflare.com and nash.ns.cloudflare.com. Reputation data show a Gridinsoft trust score of 0 out of 100 and that the domain appears on one security blocklist.

PhishDestroy has already blocked the domain, and VirusTotal reports that 12 of 95 scanned security vendors flagged the host, reinforcing the malicious classification. The observed scam type is credential phishing, consistent with the page title and blocklist attribution. The domain is currently marked as offline. Uncertainty remains regarding the specific credential collection vectors because the actual page content has not been captured; only the title and HTTP response are available.

No additional indicators such as malicious payload hashes, phishing email samples, or victim reports have been disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration of the same second‑level name, and consider adding the IP address 188.114.97.3 to host‑based deny lists. Ongoing threat‑intel feeds should be consulted for any future activity tied to the Cloudflare ASN or the observed nameservers. The combination of a valid TLS certificate, Cloudflare hosting, and a low trust score strongly suggests abuse of legitimate infrastructure for credential harvesting.