ledgrz-log-sub[.]pages[.]dev

PhishDestroy identifies ledgrz-log-sub.pages.dev as an active credential harvesting domain posing an elevated risk to users. This site is specifically designed to trick visitors into submitting sensitive login credentials under false pretenses, making it a high-priority threat for both individuals and organizations. The domain’s recent activity and low detection rate (3/95 on VirusTotal) indicate it may evade traditional defenses, requiring heightened vigilance and proactive mitigation measures.

This domain was flagged by three out of 95 VirusTotal security vendors, resolving to IP address 172.66.47.132 via Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, suggesting a false sense of legitimacy. While the exact registration date is not publicly disclosed, the domain’s use of a Cloudflare front and Google-issued SSL certificate reflects an attempt to blend into legitimate web infrastructure. The low detection rate (3/95) and lack of presence on major blocklists suggest it is either newly active or using evasion tactics to avoid detection.

To mitigate the threat posed by ledgrz-log-sub.pages.dev, users should avoid accessing the domain entirely. Organizations are advised to block the domain and IP address (172.66.47.132) at the network perimeter and DNS level. Employees should be alerted to the presence of this credential harvesting campaign, particularly if it mimics internal login portals. Security teams should monitor for any internal systems attempting to connect to this domain and conduct user awareness training focused on identifying phishing lures. If credentials were entered, users should immediately rotate passwords and enable multi-factor authentication where possible.