live-wallt-ledgre[.]pages[.]dev

PhishDestroy identifies live-wallt-ledgre.pages.dev as an active fake login page used for credential theft. This domain exhibits classic phishing characteristics, including a deceptive landing page mimicking a legitimate service to trick users into entering sensitive information. The threat is currently classified as 'under_investigation' but remains operational and poses a clear risk to unsuspecting visitors. This domain was flagged with zero detections out of 95 engines scanned on VirusTotal, indicating it has evaded conventional detection mechanisms to date. It is registered through Cloudflare, Inc., resolving to IP 188.114.96.3 and leveraging a Google Trust Services SSL certificate to appear legitimate. While creation dates and blocklist statuses are not specified, the absence of detections suggests a recently deployed or carefully crafted campaign. The use of Cloudflare's infrastructure and a trusted SSL certificate further complicates early-stage identification, as these are common techniques to bypass initial scrutiny. To mitigate exposure to this threat, users should avoid interacting with live-wallt-ledgre.pages.dev entirely. Organizations should implement network-level blocking for the resolved IP (188.114.96.3) and domain, leveraging threat intelligence feeds for proactive defense. Additionally, user awareness training highlighting the risks of credential harvesting via fake login pages—particularly those hosted on reputable services like Cloudflare Pages—is strongly recommended. Security teams should monitor for similar domains or IPs exhibiting patterns consistent with this campaign, such as recent registration dates or rapid shifts in infrastructure.