access-cdn-ledgr[.]pages[.]dev

PhishDestroy identifies access-cdn-ledgr.pages.dev as an active credential-harvesting domain operating under Cloudflare’s Pages platform. This site poses as a legitimate CDN endpoint to trick users into surrendering sensitive login data, most commonly targeting corporate or SaaS portals. Its infrastructure runs behind Google Trust Services TLS certificates on IP address 188.114.97.3, providing a veneer of legitimacy that masks its malicious intent.

This domain was flagged by PhishDestroy’s automated pipeline on seed 82ec2b with zero detections out of 95 VirusTotal engines as of the latest scan. It was registered through Cloudflare, Inc., leveraging their Pages service to host rapidly provisioned phishing kits. The combination of Cloudflare’s global CDN, Google TLS certificates, and zero initial detection rates creates a potent blend of evasion that can bypass traditional defenses and deceive even cautious users into trusting the page.

If you visited access-cdn-ledgr.pages.dev or entered any credentials on the page, immediately change passwords on all accounts possibly exposed, enable multi-factor authentication where available, and scan your device with up-to-date antivirus software. Report the incident to your IT/security team or the legitimate service owner being impersonated. Avoid reusing passwords across sites, monitor accounts for unusual activity, and verify all CDN or login pages against official sources before entering sensitive information.