ask-live-ledgor[.]pages[.]dev

PhishDestroy identifies ask-live-ledgor.pages.dev as an active phishing landing page delivering elevated risk to potential victims. This domain leverages Cloudflare Pages hosting to impersonate legitimate web services, tricking users into disclosing sensitive information such as login credentials or financial data.

This domain was flagged by 1 out of 95 VirusTotal security vendors during analysis. It resolves to IP 172.66.47.21 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, indicating an attempt to appear legitimate through trusted infrastructure. While the domain is relatively new and not broadly blacklisted, the low detection rate (1/95) and active hosting on a reputable CDN suggest a targeted or recently deployed campaign. The combination of low detection and trusted SSL issuance increases the risk of successful deception.

Users must avoid interacting with this domain to prevent credential theft or malware exposure. Organizations should block ask-live-ledgor.pages.dev at DNS and network levels using firewall rules or endpoint protection platforms. Security teams should also inspect outbound traffic from endpoints for connections to IP 172.66.47.21. Users who suspect exposure should immediately rotate passwords, enable MFA on all accounts, and monitor for signs of compromise such as unexpected login attempts or data exfiltration. Given the use of Cloudflare Pages, future variants may emerge rapidly—continuous monitoring and proactive threat hunting are recommended to mitigate this evolving threat.