desktop-ledgarcom[.]pages[.]dev

PhishDestroy identifies desktop-ledgarcom.pages.dev as an active IRS-themed phishing page designed to steal taxpayer credentials and financial data. The site mimics the U.S. Internal Revenue Service portal, prompting victims to enter Social Security numbers and banking details under the guise of a false tax refund or identity verification process. SSL certificate issued by Google Trust Services and Cloudflare Pages hosting obscure the true origin, creating a false sense of legitimacy aimed at evading browser-based warnings. This domain presents a HIGH RISK with current intelligence supporting active exploitation. VirusTotal analysis shows 9 out of 95 detection engines flagging the URL, underscoring how new and undetected this campaign remains. The domain resolves to IP 172.66.44.76 via Cloudflare Pages, a common fast-flux hosting service used to mask malicious infrastructure. Registered through Cloudflare, Inc., it leverages free-tier hosting to rapidly deploy and discard phishing pages, reducing operational costs for attackers and shortening the window for takedown. As of seed 695bd5, it has not yet been added to major threat intelligence blocklists, prolonging its exposure risk to internet users. Users who visited desktop-ledgarcom.pages.dev should immediately cease any data entry and close the browser tab. Clear browser cache and cookies related to the domain, especially session tokens or login credentials entered on the page. Reset passwords for financial accounts and enable multi-factor authentication where available. Report the domain to the IRS through phishing@irs.gov and file a complaint with the FTC at ReportFraud.ftc.gov. Monitor financial statements and credit reports for signs of identity theft. If any sensitive information was submitted, contact your bank or credit card issuer to freeze accounts and initiate fraud alerts on credit files.