aap-live-ledgar-enus[.]pages[.]dev

The domain aap-live-ledgar-enus.pages.dev has been identified as a generic phishing site targeting users through Microsoft 365 credential harvesting. Analysis indicates the domain was actively impersonating enterprise login portals to capture authentication credentials. As of the latest verification, the domain has been taken offline, though it remains under investigation for prior malicious activity. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 04, 2026, with an SSL certificate issued by Google Trust Services. The domain resolved to the IP address 188.114.97.3 and was assigned a Gridinsoft trust score of 0/100, indicating high suspicion. While VirusTotal reported 0 detections out of 95 security vendors, the domain appeared on one security blocklist and was previously blocked by PhishDestroy. The page title displayed "Suspected phishing site | Cloudflare," further confirming its compromised status. Current assessment confirms the domain is offline, though residual risk persists for users who may have interacted with it prior to takedown. Organizations are advised to monitor authentication logs for anomalous login attempts originating from this domain or its associated IP. If credentials were entered, immediate password resets and multi-factor authentication enforcement are recommended. Network administrators should update blocklists to include this domain and its resolved IP to prevent potential future access attempts. Continuous monitoring of related subdomains under the pages.dev namespace is also advised due to the likelihood of attacker infrastructure reuse.