desktop-live-ledgw[.]pages[.]dev

Analysis of desktop-live-ledgw.pages.dev indicates that the domain was created on April 08, 2026 and is operated through Cloudflare, Inc. The site currently returns an HTTP 403 status, suggesting that it is taken offline, and it is listed as "Suspected phishing site | Cloudflare" in the page title. Infrastructure observation shows resolution to IP address 188.114.96.3, which belongs to Cloudflare’s network in Canada. Nameserver records point to brodie.ns.cloudflare.com and leah.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The SSL certificate presented is issued by Google Trust Services under the WE1 hierarchy, a legitimate certificate authority, indicating that attackers have obtained a valid TLS certificate for the domain.

Threat intelligence reports reveal that nine out of ninety‑four security vendors on VirusTotal have flagged the domain, and it appears on one external security blocklist. PhishDestroy has explicitly blocked the domain, reinforcing the assessment of malicious intent. The Gridinsoft trust score is 0 out of 100, further corroborating the low reputation of the host. The identified scam type is credential phishing, targeting user credentials.

While the domain is presently offline, the combination of a recent registration date, valid SSL, Cloudflare hosting, multiple vendor detections, and blocklist entries provides concrete evidence of a phishing operation. Defenders should continue to deny any network communication to 188.114.96.3 and to the domain name, add the domain to internal URL filtering and DNS sinkhole policies, and monitor for any re‑registration or new IP resolution that may indicate a revival of the campaign. Additionally, security teams should share the indicator set with threat‑sharing platforms to aid broader community mitigation.