get-ladjer-desk[.]pages[.]dev

PhishDestroy identifies get-ladjer-desk.pages.dev as an active credential theft domain impersonating Discord to harvest user tokens. The site employs a crypto drainer mechanism to siphon cryptocurrency from compromised accounts after authentication is captured. As of the latest scan, this domain remains undetected by security vendors with 14 out of 95 VirusTotal engines flagging the threat. This domain was flagged through Cloudflare’s Pages.dev service and resolves to IP 188.114.96.3, which is associated with Google Trust Services for SSL certificate validation. The infrastructure leverages Cloudflare’s registrar, indicating a potential attempt to obscure hosting origins. Notably, the domain shows no presence on major blocklists at this time, though its recent activation suggests a short operational window aimed at evading detection. The combination of a fresh domain, low VT coverage, and Discord impersonation creates a high-risk scenario for unsuspecting users. Mitigation requires immediate action: users should avoid interacting with this domain entirely. Discord users must enable two-factor authentication (2FA) and revoke unauthorized sessions via account settings. Organizations should deploy endpoint protection to detect token exfiltration attempts and monitor for anomalous login activity. Block the IP 188.114.96.3 at the network perimeter and report the domain to Discord’s Trust & Safety team. If credentials were entered, revoke tokens via discord.com/app-settings/authorized-apps and reset passwords. This domain’s low detection rate underscores the need for proactive threat intelligence sharing to prevent widespread compromise.