ledzaer-login[.]pages[.]dev

PhishDestroy identifies ledzaer-login.pages.dev as an active credential theft domain leveraging a Google Cloudflare Pages deployment to mimic a legitimate login interface. The infrastructure suggests a crypto drainer kit, likely targeting users of cryptocurrency platforms or exchanges through brand impersonation. The domain’s naming convention (ledzaer-login) and hosting on Cloudflare’s Pages service indicate a deliberate attempt to bypass traditional email gateway filters by leveraging reputable infrastructure. No specific drainer kit signature has been publicly disclosed, but the low detection rate and SSL certificate issued by Google Trust Services imply a well-obfuscated attack chain designed for rapid evasion.

Technical indicators for ledzaer-login.pages.dev confirm its malicious intent. The domain resolves to IP 188.114.97.3, a Cloudflare edge server commonly abused for phishing campaigns. Hosted under Cloudflare, Inc., the domain registered via Google’s Pages service lacks transparency in WHOIS data, a tactic often used to delay takedown efforts. VirusTotal currently flags the domain with 6/95 detections, underscoring its evasive nature. While not yet flagged by Google Safe Browsing (GSB), the absence of detections across major AV engines highlights the need for heuristic-based detection. No public blocklist entries exist at this time, further enabling its operational window.

Current status for ledzaer-login.pages.dev remains active, with no immediate takedown observed. SOC teams are advised to block the domain at DNS and firewall levels, and flag any associated IPs or subdomains. Given the campaign’s reliance on trusted infrastructure (Cloudflare Pages + Google SSL), users should verify URLs manually and avoid autofill features for sensitive fields. Remaining risk is high due to undetected evasion tactics, necessitating continuous monitoring for new IOCs and proactive threat hunting within corporate environments.