ldgrs-live-app-info[.]pages[.]dev

PhishDestroy identifies ldgrs-live-app-info.pages.dev as an active credential harvesting domain impersonating a legitimate app store service. Current status remains under investigation as behavioral analysis continues to unfold. The domain leverages Cloudflare’s infrastructure, including a Google Trust Services SSL certificate, to lend false legitimacy to its malicious operations. Victims are directed to fraudulent login portals designed to steal Apple ID credentials under the guise of an app-related service. Initial detection indicates this threat is actively propagating via phishing campaigns targeting mobile device users seeking to access premium applications or services.

This domain was flagged by 3 out of 95 VirusTotal vendors as of the latest scan, indicating a lack of widespread signature-based detection despite its active status. Registered through Cloudflare, Inc., the domain resolves to IP address 172.66.47.129 and operates under the pages.dev subdomain of Cloudflare Pages. The domain’s creation date falls within the recent window of suspicious activity, with no prior reputation in blocklists or threat intelligence feeds. The SSL certificate issued by Google Trust Services further obfuscates its malicious nature by presenting a deceptive veneer of trustworthiness. Current risk assessment places this domain at the investigation stage, pending deeper forensic analysis of its infrastructure and operational patterns.

Users and organizations are advised to immediately block ldgrs-live-app-info.pages.dev at the network and DNS levels to prevent potential credential theft. Enterprises should deploy browser isolation policies for cloud-based productivity suites and mobile device management (MDM) platforms to restrict access to untrusted domains. Users must verify the legitimacy of app-related URLs via official channels and enable multi-factor authentication (MFA) on all critical accounts. Security teams should monitor for any IP-based or domain-based indicators associated with this campaign, including the resolved IP 172.66.47.129 and related subdomains under pages.dev. Further updates will be provided as additional intelligence becomes available.