desk-ledgrr-auth[.]pages[.]dev

PhishDestroy identifies desk-ledgrr-auth.pages.dev as an active Google Pages-hosted phishing domain currently delivering a generic credential-harvesting campaign. This site pretends to be a secure authentication portal but is designed to trick visitors into surrendering login details to threat actors. The infrastructure abuses Google’s Pages service to lend visual credibility while hosting malicious JavaScript and spoofed login forms designed to exfiltrate usernames and passwords. Users who land on this page may unwittingly submit sensitive credentials to attackers, risking account takeover and downstream financial or identity fraud.

This domain was flagged by PhishDestroy after VirusTotal detected 4 out of 95 participating security vendors classifying it as malicious, indicating a moderate but significant detection deficit among mainstream scanners. Registration was processed via Cloudflare, Inc., and the domain resolves to IP 188.114.97.3, hosted on Google’s infrastructure under the *.pages.dev wildcard certification authority operated by Google Trust Services. Current telemetry shows consistent uptime and active phishing payload delivery, with no indication of suspension or remediation at this time.

If you have visited desk-ledgrr-auth.pages.dev, immediately cease use of any credentials entered on the site and change passwords on all accounts where you reused the same email or password. Run a malware scan on your device using reputable antivirus software and monitor financial accounts for suspicious transactions. Report the domain to your email provider and browser for blocklisting and avoid clicking any links or attachments from unsolicited messages referencing this URL. Consider enabling multi-factor authentication across high-value accounts to mitigate further compromise should credentials have been exposed.