leger--live-desktop[.]pages[.]dev

PhishDestroy identifies leger--live-desktop.pages.dev as an active, currently undetected phishing domain impersonating a generic login portal. Threat actors are leveraging Cloudflare Pages to host a convincing replica aimed at harvesting user credentials under the guise of a legitimate service interface. The domain resolves to 188.114.96.3 via Cloudflare’s infrastructure and uses a Google Trust Services SSL certificate to enhance its perceived legitimacy, a common tactic to bypass security controls and trick users into trusting the page. Analysis of this domain reveals concerning technical indicators: VirusTotal shows 0 detections out of 95 security engines, indicating no current signature-based detections despite active hosting. The domain was registered through Cloudflare, Inc., a legitimate provider often abused for phishing due to its fast provisioning and anonymity features. The SSL certificate issued by Google Trust Services further complicates detection by providing a false sense of security to end users. Without proactive blocking or behavioral analysis, this domain may remain operational and undetected for extended periods. Users who visited leger--live-desktop.pages.dev should immediately inspect any entered credentials for compromise and revoke access to sensitive accounts. Enable multi-factor authentication wherever possible and report unauthorized login attempts to your IT security team. If your organization uses DNS filtering or endpoint protection, add this domain to your blocklist using the IP 188.114.96.3 and the domain name. Monitor for unusual authentication patterns from trusted user accounts and remain vigilant for follow-on spear-phishing or credential stuffing attacks leveraging harvested data.