ledgar-us-live[.]pages[.]dev

The domain ledgar-us-live.pages.dev has been identified as a phishing infrastructure specifically designed to impersonate Cloudflare authentication portals. Analysis confirms this as a targeted credential harvesting operation, currently classified under generic phishing threat type. The domain has been taken offline, though prior activity remains under investigation by security teams. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 06, 2026, with an SSL certificate issued by Google Trust Services. It resolved to the IP address 172.66.46.243 and appeared on one security blocklist. Despite these indicators, the domain received zero detections from 95 VirusTotal vendors, highlighting potential gaps in automated detection. Gridinsoft assigned a trust score of 0/100, and the page title explicitly stated 'Suspected phishing site | Cloudflare,' suggesting self-identification or misconfiguration. Current status shows the domain as offline, though historical data indicates active malicious use. Organizations are advised to monitor network logs for connections to 172.66.46.243 and review authentication attempts from affected timeframes. Security teams should update blocklists with the domain and IP, while users should verify SSL certificates and page titles when accessing legitimate Cloudflare services. Additional scrutiny of domains registered through the same infrastructure provider is recommended.