ledhghy-gnnmbkj[.]pages[.]dev

This domain, ledhghy-gnnmbkj.pages.dev, operates as a fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the site mimics legitimate login pages, likely targeting corporate or financial service credentials to facilitate unauthorized account access or identity theft. The infrastructure and design patterns align with credential phishing campaigns observed in recent threat intelligence reports. Infrastructure analysis reveals the domain was registered on April 09, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.118. It holds a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100, with 17 out of 95 security vendors on VirusTotal flagging it as malicious. The domain appears on one security blocklist and is currently offline, though its SSL certificate was issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. Users who visited ledhghy-gnnmbkj.pages.dev or entered credentials on the site should immediately reset passwords for any accounts accessed from the same device or network. Enable multi-factor authentication where available and monitor accounts for unauthorized activity. Scan the device for malware using updated security tools, as phishing sites may deploy additional payloads. Report the incident to relevant security teams or platforms to aid in broader threat mitigation efforts.