wllet-ledgre-live[.]pages[.]dev

Analysis of wllet-ledgre-live.pages.dev shows that the domain is actively used for a generic phishing campaign. VirusTotal records indicate that 13 of 91 security vendors have flagged the domain, demonstrating a non‑trivial detection rate across multiple scanning engines. The domain is presently listed on a security blocklist and is blocked by the PhishDestroy service, confirming that active mitigation actions are already in place in at least one anti‑phishing platform.

Infrastructure details reveal that the domain is registered through Cloudflare, Inc. and resolves to the IP address 172.66.44.68, which belongs to Cloudflare's edge network. The authoritative nameservers are kami.ns.cloudflare.com and wilson.ns.cloudflare.com, both standard Cloudflare resolver entries, suggesting that the attacker is leveraging Cloudflare's CDN and DNS services to obscure the true origin of the traffic. No additional intelligence such as Safe Browsing verdicts, SSL certificate details, HTTP response codes, or page title information is currently available, leaving the exact content and user‑facing behavior of the site unverified.

Defenders should therefore treat any outbound connections to wllet-ledgre-live.pages.dev as malicious, enforce DNS‑level blocking, and consider adding the domain to internal deny‑list policies. Continuous monitoring of DNS queries for this domain, correlation with endpoint alerts, and periodic re‑scanning with multi‑vendor tools are advised to capture any changes in the payload or hosting configuration. Given the existing blocklist entry and the multi‑vendor detections, the risk posture remains elevated until the domain is fully takedown or its activity ceases.