access-ledgrlive-faqs[.]pages[.]dev

access-ledgrlive-faqs.pages.dev was observed on July 29, 2026 as an active generic phishing infrastructure with an elevated risk rating. The domain resolves to the IPv4 address 172.66.44.201 and is hosted behind Cloudflare, Inc., as indicated by the authoritative nameservers alex.ns.cloudflare.com and olga.ns.cloudflare.com. Registration data show the domain is provisioned through Cloudflare’s reseller service, which masks end‑user details and is a common vector for abuse.

The domain appears on one public security blocklist and is explicitly listed by the PhishDestroy sink‑hole feed, confirming that at least one defensive organization has identified it as malicious. VirusTotal analysis reports that 7 of 91 scanned security vendors flag the domain as malicious, providing independent corroboration of its phishing nature. No additional public reputation sources such as Google Safe Browsing, OTX, or SSL/TLS certificate details are available in the current intelligence set, and the page title or content has not been captured, leaving the exact phishing lures unknown.

Given the limited but consistent evidence—blocklist inclusion, PhishDestroy confirmation, and multi‑vendor detection—the domain should be treated as a confirmed phishing site. Defensive teams are advised to add 172.66.44.201 and the full FQDN to network and DNS blocklists, enforce outbound filtering to prevent credential submission, and monitor for any new indicators that may arise from subsequent scans. Continuous re‑evaluation is recommended, as additional analysis of the web payload could reveal target brands or credential‑harvesting techniques that would refine detection rules.