larn-ledgr-liv[.]pages[.]dev

This domain is flagged under investigation for credential harvesting phishing activity targeting users through deceptive login interfaces. Analysis indicates the domain was registered to mimic legitimate financial or corporate services, a common tactic in credential theft campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. It resolves to the IP address 188.114.96.3 and was created on March 30, 2026. Despite its recent registration, the domain appears on one security blocklist and has been blocked by at least one threat intelligence feed. Detection engines report 0/95 flags on VirusTotal, while Gridinsoft assigns a trust score of 0/100, indicating high suspicion with no legitimate indicators. Mitigation steps for credential harvesting threats include immediate domain blocking at the network perimeter and endpoint levels. Security teams should review logs for connections to 188.114.96.3 or the domain name in proxy, DNS, or firewall records. If user interaction is suspected, reset credentials accessed during the exposure window and enable multi-factor authentication on all critical accounts. Monitor for follow-up phishing attempts using similar domain patterns, particularly those mimicking financial or corporate login portals.