sso-ldger-start[.]pages[.]dev

PhishDestroy identifies sso-ldger-start.pages.dev as a credential-phishing page masquerading as a legitimate single sign-on (SSO) login portal. This fake login domain attempts to trick users into surrendering corporate or personal credentials by presenting a convincing replica of an enterprise authentication interface. Recent telemetry shows the domain resolving to IP 172.66.47.131 and using a Google Trust Services SSL certificate, likely to appear legitimate. The use of a Cloudflare Pages subdomain adds to its facade of authenticity, increasing the chance that users will overlook red flags during rushed or distracted sessions.

This domain was flagged by PhishDestroy as an active credential-phishing campaign under investigation. Intelligence indicates it currently shows 0 detections across 95 VirusTotal scanners, meaning traditional antivirus engines have not yet added signatures. It is registered through Cloudflare, Inc., a common hosting choice for short-lived phishing infrastructure. The combination of zero blocklist detections, a Google-issued SSL certificate, and a Cloudflare front-end suggests this is a newly deployed campaign designed to evade early detection while harvesting credentials from unsuspecting users.

If you visited sso-ldger-start.pages.dev and entered any credentials, assume they have been compromised immediately. Do not use those credentials on other accounts. Disable any saved sessions tied to the exposed password, enable multi-factor authentication on all critical accounts, and report the incident to your IT or security team. Review account login logs for suspicious activity in the past 48 hours. Consider using a password manager to prevent reuse across services, and warn colleagues who may have been targeted by the same lure. Stay vigilant: attackers often reuse compromised identities in follow-on social engineering or spear-phishing attacks.