en-us-livledgr[.]pages[.]dev

PhishDestroy identifies the active credential theft scam operating at en-us-livledgr.pages.dev as of seed 67a7c7. This domain is currently masquerading as a legitimate service to harvest user credentials for malicious purposes. The threat remains active and is being tracked by threat intelligence platforms.

This domain was flagged by 1 of 95 VirusTotal vendors, confirming its malicious nature. The registrar is Cloudflare, Inc., and the domain resolves to IP 188.114.97.3. The SSL certificate is issued by Google Trust Services. The domain was created recently, contributing to its elevated risk profile. The low VirusTotal detection rate suggests an attempt to evade initial detection mechanisms.

The current status of en-us-livledgr.pages.dev is active, posing an elevated risk to users who may unknowingly submit credentials. Immediate action is required: block the domain at the network perimeter and instruct users to avoid interacting with it. Security teams should investigate network logs for any outbound connections to this IP or domain. Users who have already entered credentials should change passwords immediately and enable multi-factor authentication where possible. Monitor for any signs of credential misuse or subsequent phishing attempts.