store-ledgr-live[.]pages[.]dev

The domain store-ledgr-live.pages.dev has been identified as a credential harvesting phishing site targeting financial or accounting service users. Analysis indicates the domain is currently offline, with no active content accessible for further inspection. The page title previously displayed by the hosting provider was 'Suspected phishing site | Cloudflare,' suggesting automated detection of malicious intent prior to takedown. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 03, 2026, an anomalous future date likely indicative of falsified registration details. It resolved to the IP address 172.66.46.232, a Cloudflare-hosted endpoint commonly used for both legitimate and malicious content. Security telemetry shows the domain appeared on a single blocklist, while VirusTotal recorded 0 detections out of 95 vendors, indicating limited initial visibility. The Gridinsoft trust score for this domain was 0 out of 100, reflecting high-risk classification. The SSL certificate was issued by Google Trust Services, providing encrypted connections that may have been leveraged to lend false legitimacy to the phishing attempt. Current status confirms the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated. Organizations are advised to proactively block the domain and associated IP address 172.66.46.232 at the perimeter. Security teams should monitor for similar domains using the 'ledgr' keyword or Cloudflare Pages subdomains with anomalous registration dates. Endpoint protection rules should be updated to flag any future connections to this domain or its resolved IP. Given the use of encryption and reputable hosting infrastructure, user awareness training should emphasize caution with domains mimicking financial or accounting services, even when secured by valid SSL certificates.