ledzer-start-co[.]pages[.]dev

PhishDestroy identifies ledzer-start-co.pages.dev as an active Microsoft 365 credential harvesting page posing as a legitimate login portal. This site mimics the Microsoft authentication workflow to trick users into surrendering their enterprise or personal Microsoft account credentials. The threat is particularly dangerous for organizations using Microsoft 365, as stolen credentials can grant access to sensitive emails, files, and collaborative tools such as Teams and SharePoint. Security teams should treat this domain as a high-priority security incident if it appears in logs or user reports. This domain was flagged by only 1 out of 95 VirusTotal security vendors, indicating low initial detection but high potential impact. It is hosted on Cloudflare (via pages.dev) and resolves to IP 172.66.47.45. The site uses a Google Trust Services SSL certificate to appear legitimate, which is a common tactic to bypass browser warnings. While only one vendor flagged it at the time of analysis, the combination of Microsoft 365 branding, Cloudflare hosting, and recent activation signals a coordinated phishing operation likely targeting businesses and professionals. If you have visited this site, assume your Microsoft 365 credentials may have been compromised. Immediately change your password through a known-safe channel (e.g., directly via portal.office.com or your company’s IT portal) and enable multi-factor authentication (MFA). Scan your device for malware using a trusted antivirus tool and review your Microsoft 365 account for unusual login locations or forwarded emails. Report the incident to your IT or security team. Avoid clicking any links from emails referencing this domain and warn colleagues who may have encountered it. This domain should be added to your organization’s blocklist and monitored for further activity.