lejar-live-desktoop[.]pages[.]dev

PhishDestroy identifies the active phishing domain lejar-live-desktoop.pages.dev impersonating a software update portal to deliver malicious payloads. The campaign is currently under investigation by threat intelligence teams and remains active as of the latest assessment. lejar-live-desktoop.pages.dev was flagged by 14 of 95 VirusTotal vendors, indicating undetected malicious activity at the time of analysis. This domain resolves to IP 172.66.47.106 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may contribute to initial trust perception by users. While no blocklist entries or trust score metrics are publicly available, the absence of detections highlights a critical window of exposure for potential victims. Users and organizations are advised to block access to lejar-live-desktoop.pages.dev and monitor for related infrastructure. Exercise caution with unsolicited software update prompts, especially those delivered via email or pop-up windows. Report suspicious domains to threat intelligence platforms and ensure endpoint protection is updated to detect evolving delivery vectors. The campaign’s reliance on Cloudflare and Google Trust Services underscores the need for layered defense mechanisms, including DNS filtering and user awareness training, to mitigate risks associated with unflagged malicious domains.