us-lidgor-starts[.]pages[.]dev

PhishDestroy identifies us-lidgor-starts.pages.dev, a credential harvesting page currently under investigation for active phishing campaigns. This domain poses a significant threat as it impersonates legitimate login portals to deceive users into surrendering sensitive credentials. The site remains undetected by security vendors, with VirusTotal showing 0/95 detections as of the latest scan. This domain was registered via Cloudflare, Inc. and resolves to IP address 188.114.97.3. It operates under an SSL certificate issued by Google Trust Services, which may lend false legitimacy to unsuspecting visitors. The use of Cloudflare’s Pages.dev service further obscures malicious intent by leveraging a trusted hosting provider. Despite its recent deployment, the domain has not yet been added to major blocklists, increasing the risk of exposure to potential victims. The absence of detections and current lack of countermeasures underscore the urgency of proactive monitoring and user awareness. To mitigate the threat posed by us-lidgor-starts.pages.dev, users should avoid interacting with unsolicited login prompts or links, especially those hosted on suspicious subdomains or unfamiliar platforms. Organizations should implement advanced email filtering to block domains associated with Cloudflare Pages.dev and monitor outbound traffic for connections to IP 188.114.97.3. Immediate reporting of this domain to security teams or platforms like PhishDestroy can help accelerate mitigation efforts. Exercise caution and verify the authenticity of login pages before entering credentials, even if they appear secured by a valid SSL certificate.