faqs-liveledgr[.]pages[.]dev

PhishDestroy’s automated threat analysis systems have flagged the domain faqs-liveledgr.pages.dev as an active brand impersonation phishing host designed to trick users into surrendering sensitive credentials. This infrastructure leverages the Cloudflare Pages platform to host spoofed login pages resembling legitimate financial or corporate portals. The page is served over a Google Trust Services SSL certificate (valid chain) to enhance believability, while the backend resolves to Cloudflare IP 172.66.44.172, a known edge node used by threat actors to obscure origin servers. Early behavioral analysis indicates lures referencing “live ledger” or “FAQ updates” to prompt visits, followed by credential harvesting or crypto drainer payloads. This domain was flagged by PhishDestroy on seed 6615d7 with zero VirusTotal detections out of 95 engines as of the latest scan, indicating minimal detection coverage across the security community. The domain was registered through Cloudflare, Inc., operates on Cloudflare Pages infrastructure, and currently resolves to IP 172.66.44.172. It shows no presence on major threat intelligence blocklists at this time, underscoring the importance of proactive user vigilance and real-time monitoring. If you have visited faqs-liveledgr.pages.dev, immediately cease any data entry or wallet connection attempts. Revoke any session tokens or API keys exposed during the visit, rotate passwords on related accounts, and inspect connected crypto wallets for unauthorized transactions. Report the domain to your security team or platform abuse channels while avoiding re-visitation. Monitor financial and identity accounts for anomalous activity over the next 30 days. Consider enabling hardware security keys or biometric authentication on high-value accounts to mitigate future credential theft attempts.