io-en-ledgeer[.]pages[.]dev

PhishDestroy classifies io-en-ledgeer.pages.dev as an active generic phishing campaign with a current risk level of under_investigation. This domain poses a significant threat by impersonating legitimate login portals to harvest user credentials. The infrastructure leverages Cloudflare Pages for hosting and Google Trust Services for SSL certificates, increasing the appearance of legitimacy while evading early detection. This domain was flagged with 2/95 VirusTotal detections as of the investigation seed 20cfa7, indicating no prior recognition by antivirus engines. It resolves to IP address 188.114.96.3, registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, a tactic commonly used to bypass enterprise TLS inspection and social engineering defenses. The domain remains unlisted on all major blocklists at the time of analysis, further enabling its operational window. To mitigate exposure, users should immediately block io-en-ledgeer.pages.dev at the network and endpoint levels. Avoid interacting with any content hosted on this domain, including embedded forms or downloadable files. Report the domain to your security team and to threat intelligence platforms such as VirusTotal and PhishDestroy using seed 20cfa7. If credentials were entered, assume compromise and initiate password resets and multi-factor authentication enrollment across affected accounts. Monitor for follow-on spear-phishing or credential stuffing attempts targeting the exposed user base.