live-ledgrr-en-us[.]pages[.]dev

PhishDestroy identifies live-ledgrr-en-us.pages.dev as an active credential-harvesting campaign currently propagating under Google Trust Services SSL. This Cloudflare Pages domain resolves to 188.114.96.3 and remains undetected by VirusTotal at 1/95 detections. The seed identifier 914b8a confirms this is a live deployment rather than a stale indicator; users encountering this link should treat it as hostile and refrain from entering any credentials. The domain is registered via Cloudflare, Inc. and leverages a Google Trust Services certificate to enhance phishing realism. VirusTotal currently shows 1/95 security vendors flagging the page, indicating it has evaded automated detection networks despite active redirection to a spoofed US ledger login form. The IP address 188.114.96.3 is associated with Cloudflare’s edge network, a common tactic among phishing actors to obfuscate infrastructure origins. This configuration enables rapid propagation and operational agility, making takedowns more challenging. Mitigation requires immediate browser isolation and network blocking of 188.114.96.3 and live-ledgrr-en-us.pages.dev. Users who entered credentials should rotate passwords immediately and enable multi-factor authentication on all linked accounts. Report the domain to your email security provider and to PhishDestroy using seed 914b8a to accelerate classification. Organizations should update blocklists with the exact domain and IP to prevent further exposure.