com-ledgr-satrt[.]pages[.]dev

PhishDestroy identifies com-ledgr-satrt.pages.dev as an active Google Docs login-themed phishing page designed to trick users into surrendering their Google credentials. The site presents a fake Google Docs login overlay that harvests entered email and password combinations, which are then transmitted to attacker-controlled servers. Security researchers note that this technique is frequently used in credential-stuffing attacks and is particularly effective against users who multitask across multiple browser tabs. This domain was flagged by PhishDestroy on seed a894d2 with a confirmed VirusTotal detection count of 7/95 antivirus engines as of our investigation window. The domain resolves to IP 188.114.96.3 and is registered through Cloudflare, Inc., leveraging Google Trust Services SSL certificates to appear legitimate. The phishing page itself is hosted on Cloudflare Pages, which provides rapid deployment and easy domain generation that helps threat actors quickly establish and abandon infrastructure. If you visited com-ledgr-satrt.pages.dev, immediately check your Google Account security settings at myaccount.google.com and enable two-factor authentication. Change passwords for any accounts that may have used the same credentials. Report the incident to Google via their phishing reporting tool and run a malware scan using a trusted antivirus suite. Avoid entering any credentials on this domain and block the IP 188.114.96.3 at your firewall if possible. Monitor your email and financial accounts for unusual activity for at least 30 days following potential exposure.