apps-desktop-ledge[.]pages[.]dev

PhishDestroy confirms apps-desktop-ledge.pages.dev is actively hosting a malicious fake desktop application installer designed to deceive users into downloading counterfeit software. The domain mimics legitimate desktop application distribution platforms, suggesting a deliberate impersonation of trusted software vendors. No specific brand or drainer kit has been identified in current telemetry, but the generic lure implies a broad targeting strategy rather than a single high-value victim profile.

This domain resolves to IP 188.114.97.3 and was registered through Cloudflare, Inc. VirusTotal currently shows 10/95 security vendors detecting the URL as malicious, and the domain holds a valid SSL certificate issued by Google Trust Services. The domain was created using Cloudflare’s Pages service, which enables rapid deployment of static sites, often exploited in phishing campaigns for its speed and anonymity. At the time of analysis, the domain remains unlisted on major blocklists, though dynamic threat intelligence suggests active redirection or content changes may occur frequently.

The threat remains active and under investigation, with no immediate blocklist inclusion observed. Users are advised to avoid downloading software from unverified sources and to verify URLs before interaction. Network defenders should monitor for connections to IP 188.114.97.3 and consider blocking the domain at the DNS or perimeter level. While detection remains low, the operational pattern aligns with emerging fake installer campaigns leveraging cloud-based hosting to evade detection. Remaining risk is moderate due to active status and absence of widespread blocking.