live-ldgrlive[.]pages[.]dev

PhishDestroy identifies domain live-ldgrlive.pages.dev as a credential-stealing phishing page impersonating a legitimate login portal. Registered via Cloudflare, Inc., this domain leverages Cloudflare Pages to host a malicious page designed to harvest user credentials under the guise of authentic branding. The phishing kit has not yet been classified in open-source drainer databases but is actively serving malicious content targeting unsuspecting users.

Technical analysis reveals this domain resolves to IP 172.66.44.129 and is secured with a Google Trust Services SSL certificate, increasing its perceived legitimacy. At time of analysis, VirusTotal reports 0 detections out of 95 scanners, which is expected for a newly deployed threat. The domain is served through Cloudflare Pages and has not yet appeared on any major blocklists, leaving it in an early operational phase. WHOIS data indicates recent registration via Cloudflare, Inc., further aligning with known abuse patterns of this provider’s dynamic hosting services.

This domain remains active and under investigation. Users are advised not to interact with any links or content associated with live-ldgrlive.pages.dev. Security teams should immediately block the domain at the network perimeter and monitor endpoints for anomalous outbound connections to 172.66.44.129. Given the absence of detections on VirusTotal and lack of blocklist inclusion, the risk of successful compromise remains moderate until broader detection signatures are deployed and enforcement actions are taken. Remain vigilant for reports of credential theft linked to this domain.