leager-live-deskt[.]pages[.]dev

PhishDestroy identifies an active credential phishing campaign using the domain leager-live-deskt.pages.dev, impersonating Google Docs live document sharing to harvest user credentials. The domain is currently operational and under investigation after initial detection by automated threat intelligence feeds. leager-live-deskt.pages.dev was flagged by 11 of 95 VirusTotal vendors at time of analysis, indicating low detection coverage despite clear malicious intent. The domain is registered through Cloudflare, Inc., resolves to IP 188.114.97.3, and holds an SSL certificate issued by Google Trust Services, which may increase user trust and decrease suspicion during access. The domain exhibits high-risk characteristics including its use of Google’s *.pages.dev subdomain space combined with a leetspeak variation of 'league' in the primary label, designed to bypass basic detection filters. Threat telemetry shows consistent availability since initial discovery with no active takedown as of current assessment. This domain poses a HIGH risk to users engaging with shared document links, particularly in enterprise environments where Google Workspace integration is common. The threat actor leverages legitimate Google infrastructure (Cloudflare, Google SSL) to enhance credibility, increasing the likelihood of successful credential theft. PhishDestroy recommends immediate network-level blocking of 188.114.97.3 and the domain leager-live-deskt.pages.dev via DNS sinkholing or firewall rules. Users should be alerted to avoid opening unsolicited document sharing links, verify sender authenticity through official channels, and report any suspicious login attempts to security teams. Continuous monitoring of this domain for new subdomains or infrastructure changes is advised due to its active status and low detection rate.