ldgr-wlt-en[.]pages[.]dev

PhishDestroy identifies ldgr-wlt-en.pages.dev as an active phishing domain designed to impersonate a legitimate account login page, potentially harvesting user credentials for fraudulent activities. This domain, currently resolving to IP address 188.114.96.3, has been flagged by only 2 out of 95 security vendors on VirusTotal, indicating a significant evasion capability against detection systems. Cloudflare, Inc. facilitated its registration via pages.dev, leveraging Google Trust Services for its SSL certificate to appear more convincing to unsuspecting users.

The threat this domain poses is particularly insidious due to its low detection rate, which suggests it may be a recently deployed or highly targeted campaign. The combination of a seemingly trustworthy SSL certificate from a reputable provider and hosting on Cloudflare’s infrastructure adds layers of legitimacy that could deceive users into believing the site is safe. Attackers typically use such domains to harvest login credentials, payment details, or other sensitive information under the guise of authentic services, such as banking, email, or corporate portals.

If you have visited ldgr-wlt-en.pages.dev, assume your credentials or personal data may have been compromised. Immediately change the passwords for any accounts where you might have entered login details, and enable multi-factor authentication where available. Use a reputable security tool to scan your device for malware or unauthorized access. Report the domain to your IT security team or platform administrators if you accessed it on a corporate device. Avoid interacting with the site further, as it may deliver additional malicious payloads. Monitor your financial and personal accounts closely for any signs of unauthorized activity.