manage-public-ledgrlive-app[.]pages[.]dev

manage-public-ledgrlive-app.pages.dev is flagged as an active generic phishing infrastructure as of July 29, 2026. The domain resolves to the IPv4 address 172.66.46.221, which is hosted by Cloudflare, Inc. Registration details indicate the domain was provisioned through Cloudflare's registrar service and utilizes the authoritative nameservers marissa.ns.cloudflare.com and sterling.ns.cloudflare.com. The domain currently appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that at least one anti‑phishing provider has identified it as malicious.

VirusTotal records show that the domain has been submitted to 91 antivirus and URL‑reputation engines; at the time of analysis none of the engines reported a detection, a result that should be interpreted as an absence of current alerts rather than evidence of benign intent. No public Safe Browsing, OTX, or SSL certificate information is available for this host, and the HTTP response characteristics have not been disclosed, limiting insight into the delivery mechanisms employed. The lack of a visible page title or captured content means the exact impersonated brand or login portal cannot be confirmed, and analysts should treat the site as a potential credential‑harvesting gateway.

Defenders are advised to add the domain and its resolved IP address to network‑level deny lists, ensure DNS filtering solutions block queries to the domain, and monitor outbound traffic for connections to Cloudflare‑hosted endpoints that match the observed IP. Continuous re‑scanning with multi‑engine services is recommended to detect any future changes in detection status. Incident response teams should also consider sinkholing the domain, if permissible, to disrupt the threat actor’s infrastructure and collect additional telemetry.