learns-live-ledgr[.]pages[.]dev

PhishDestroy identifies an active phishing domain, learns-live-ledgr.pages.dev, masquerading as a legitimate learning platform to deceive users into entering sensitive credentials. This domain employs Cloudflare’s infrastructure, resolving to IP 172.66.47.180, and leverages a Google Trust Services SSL certificate to establish false legitimacy. The threat is currently under investigation but remains operational, posing a significant risk to users who may inadvertently disclose personal or financial information under the guise of a trusted educational service.

This domain was flagged by PhishDestroy’s automated systems after VirusTotal analysis returned 0 detections out of 95 security engines, indicating a low immediate detection rate despite its malicious intent. The domain is registered through Cloudflare, Inc., a common choice among threat actors to obscure their origins and evade takedowns. While the exact creation date is not provided, the use of Cloudflare’s Pages.dev subdomain suggests a relatively recent deployment, typical of fast-flux phishing campaigns designed to remain operational for short periods. The absence of blocklist entries at this stage further highlights the domain’s ability to bypass initial screening mechanisms.

If you have interacted with learns-live-ledgr.pages.dev, particularly by entering any credentials or personal information, immediately change passwords for any accounts associated with this interaction and enable multi-factor authentication where possible. Scan your device for malware using reputable antivirus software, as phishing domains like this often deploy secondary payloads. Report the domain to your organization’s security team or to platforms like Google Safe Browsing, PhishTank, or your local cybercrime unit. Avoid clicking any links or downloading files from this domain. For further analysis, access the detailed PhishDestroy report using seed caac0c to track updates on this threat’s status and mitigation efforts.