live-ledgr-dnload[.]pages[.]dev

This domain live-ledgr-dnload.pages.dev is currently active and classified as a generic phishing campaign with an elevated risk rating. Infrastructure analysis shows it resolves to the IPv4 address 172.66.44.161, which is hosted by Cloudflare, Inc. The domain is registered through Cloudflare’s registrar service and uses Cloudflare’s authoritative nameservers henrik.ns.cloudflare.com and melissa.ns.cloudflare.com. It appears on one public security blocklist and has been explicitly blocked by the PhishDestroy service, indicating that multiple threat‑intelligence feeds have observed malicious use.

VirusTotal reports that nine out of ninety‑one scanning engines flag the domain, providing additional independent confirmation of malicious intent. No public Safe Browsing, OTX, or other reputation services are referenced in the available data, and details such as SSL certificate properties, HTTP response codes, page title, or content snapshots have not been disclosed. The limited visibility means defenders cannot confirm the exact payload or lure employed, but the convergence of blocklist inclusion, registrar information, and multi‑vendor detections suggests a high probability of credential‑harvesting activity.

Organizations should add 172.66.44.161 to network‑level deny lists, block live‑ledgr‑dnload.pages.dev at DNS resolvers, and monitor outbound traffic for connections to Cloudflare‑hosted IP ranges lacking legitimate business justification. Continuous re‑evaluation is advised as additional intelligence, such as updated VirusTotal scans or Safe Browsing verdicts, may become available.