ladgrs-live[.]pages[.]dev

PhishDestroy identifies ladgrs-live.pages.dev as an active generic phishing domain currently under investigation, exhibiting high-risk behavior aligned with credential theft campaigns. This domain is not yet flagged by most detection engines, with VirusTotal reporting 9/95 detections as of the latest scan. The infrastructure leverages Cloudflare's pages.dev subdomain service, resolving to IP 172.66.45.35, and utilizes a Google Trust Services SSL certificate to establish false legitimacy. While the specific impersonated brand remains unverified, the threat type is classified as generic phishing, indicating potential targeting of unsuspecting users through deceptive login prompts or credential harvesting forms. This domain was flagged by PhishDestroy due to its active status, absence from blocklists, and reliance on trusted cloud service providers to obfuscate malicious intent. The infrastructure details include registration through Cloudflare, Inc., with the domain resolving to IP address 172.66.45.35. The SSL certificate issued by Google Trust Services may further lull users into a false sense of security, as phishing domains often exploit reputable certificate authorities to appear authentic. At present, the domain remains undetected by 95 leading security vendors, highlighting the evasive nature of this threat. The combination of a trusted CDN provider, valid SSL certificate, and low detection rate suggests this domain is actively being used in credential theft operations, likely targeting users through misleading redirects or spoofed login pages. To mitigate exposure to this threat, users should avoid interacting with ladgrs-live.pages.dev and similar subdomains hosted on pages.dev. Enterprises and individuals should implement DNS filtering to block access to the resolved IP 172.66.45.35 and monitor for anomalous login attempts linked to this domain. Additionally, enabling multi-factor authentication (MFA) on all accounts can mitigate the risk of credential theft, even if users inadvertently submit credentials to phishing forms. Security teams should prioritize the submission of this domain to threat intelligence feeds to improve detection rates and collaborate with Cloudflare to investigate potential abuse of their Pages service. For immediate protection, users are advised to verify URLs manually, avoid clicking unsolicited links, and report suspicious domains to their IT security teams or through tools like PhishDestroy's reporting system.