secure-ldgr-live-doc[.]pages[.]dev

PhishDestroy has opened an active investigation into the domain secure-ldgr-live-doc.pages.dev following its identification as a credential phishing host. This domain is currently under analysis due to its active role in harvesting user credentials under the guise of a legitimate service. The domain does not appear to impersonate a specific brand but instead presents itself as a secure document-sharing portal, a common tactic used by threat actors to lower user suspicion. No known drainer kit signatures have been detected at this stage, suggesting either a custom-built kit or a newly deployed campaign.

Technical analysis reveals this domain is registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services, which may enhance its credibility. The domain resolves to IP address 188.114.96.3 and currently shows zero detections on VirusTotal out of 95 scans, indicating a low detection rate among security vendors. This lack of detection, combined with the use of a trusted SSL provider, suggests a sophisticated approach aimed at bypassing traditional security measures. Further investigation is required to determine the exact creation date and additional infrastructure tied to this campaign.

The current status of this domain is active, with an under-investigation risk level assigned by PhishDestroy. Immediate defensive actions include flagging the domain for blocking at the network perimeter and collaborating with hosting providers to disrupt access. Users are strongly advised to avoid interacting with this domain and to report any suspicious activity to their IT security teams. The remaining risk is classified as active but contained, pending further forensic analysis. Organizations should monitor for any shifts in infrastructure or campaign tactics, as the absence of detections may indicate an emerging threat with potential to escalate.