start-us-ledgecm-x[.]pages[.]dev

PhishDestroy identifies start-us-ledgecm-x.pages.dev as an active credential harvesting domain with an elevated risk level. This domain is designed to trick users into entering sensitive login credentials under the guise of a legitimate service.

This domain was flagged by PhishDestroy with an elevated risk level and classified as a generic phishing threat. The domain resolves to IP 188.114.97.3, is registered through Cloudflare, Inc., and holds a Google Trust Services SSL certificate. VirusTotal analysis shows only 1 out of 95 security vendors flagged this domain as malicious, indicating low detection rates despite clear malicious intent. The domain is hosted on Google's pages.dev platform, which is frequently abused for phishing campaigns due to its legitimate appearance and free hosting capabilities.

Credential harvesting domains like start-us-ledgecm-x.pages.dev pose significant risks to users who may unknowingly disclose login credentials, financial information, or personal data. The low detection rate on VirusTotal (1/95) highlights the challenge traditional antivirus solutions face in identifying these threats. Users should avoid interacting with this domain entirely. If credentials were entered, immediately change passwords on all accounts using the same credentials and enable multi-factor authentication where available. Report the domain to your organization's security team or to Google Safe Browsing if you have access to their reporting tools. Organizations should consider blocking this IP (188.114.97.3) and domain at the network perimeter to prevent employee exposure.