explore-work-ledgrlive-easily[.]pages[.]dev

The domain explore-work-ledgrlive-easily.pages.dev was observed on July 29 2026 as part of a generic phishing investigation. Infrastructure analysis shows the domain is hosted on Cloudflare’s network, using the authoritative name servers marissa.ns.cloudflare.com and sterling.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to Cloudflare’s edge infrastructure and provides both DNS and HTTP front‑end services. The registration record lists Cloudflare, Inc. as the registrar, indicating the domain was created through Cloudflare’s domain‑privacy service.

The domain appears on a single public security blocklist and is actively blocked by the PhishDestroy feed, suggesting that at least one downstream security product has identified it as malicious. VirusTotal has processed the domain with 91 scanning engines; none of the engines returned a detection, which does not constitute a safety guarantee but reflects the current lack of signature‑based matches. No additional intelligence such as SSL certificate details, page title, or brand targeting is available at this time, limiting the ability to attribute the phishing campaign to a specific victim sector. The observable evidence therefore points to a recently provisioned Cloudflare‑hosted domain that is being used for phishing, but the precise payload or credential‑harvesting vector remains unknown.

Defenders should treat the domain as hostile. Recommended actions include adding the domain to URL filtering lists, enforcing block‑or‑allow policies at the DNS resolver level, and monitoring outbound traffic for connections to 188.114.96.3. Continuous re‑scanning with updated threat‑intel feeds is advised, as the risk level is listed as “under investigation” and the activity status is active.