io-download-ldgr[.]pages[.]dev

PhishDestroy identifies the domain io-download-ldgr.pages.dev as an active phishing campaign leveraging a fake download lure to deceive users. The threat type is classified as generic_phishing, indicating a broad but deliberate attempt to impersonate legitimate download sources to harvest credentials or deliver malware. No specific brand or drainer kit has been associated with this domain at this stage of investigation, though the use of a Pages.dev subdomain suggests an attempt to mimic legitimate developer or documentation pages under the guise of a download portal. The page’s SSL certificate is issued by Google Trust Services, which may lend an initial air of legitimacy to unsuspecting users, a common tactic in phishing operations to bypass early suspicion.

Technical indicators for this domain reveal critical details supporting its malicious classification. VirusTotal currently reports 0 detections out of 95 scanning engines, indicating that mainstream security platforms have not yet flagged this domain. The domain is registered through Cloudflare, Inc., and resolves to IP address 188.114.97.3, a Cloudflare infrastructure IP commonly used to obfuscate hosting origins. While the exact creation date is not provided in the available data, the use of a pages.dev subdomain suggests a relatively recent registration, as these are typically provisioned for short-term or project-specific deployments. Google Safe Browsing (GSB) status is not yet flagged, and no public blocklist counts are associated with this domain at this time, further emphasizing the stealthy nature of this campaign.

The current status of this domain is active, with no known takedown or remediation efforts initiated. PhishDestroy’s investigation remains under review, and the risk level is currently marked as under_investigation, though the active hosting and lack of detection strongly suggest immediate risk to users encountering this page. Response actions include continued monitoring of the domain, IP, and associated infrastructure for pattern changes or escalation in malicious activity. The remaining risk is assessed as moderate to high due to the absence of detection coverage, the use of trusted infrastructure, and the lure’s plausible premise. Users are advised to avoid interacting with any download prompts from this domain and to report encounters to their security teams or through threat intelligence platforms. Organizations are encouraged to block the domain and IP at the network perimeter and to enhance user awareness regarding fake download scams leveraging cloud-based hosting providers.