live-web-ldgr[.]pages[.]dev

PhishDestroy identifies the domain live-web-ldgr.pages.dev as an active credential-theft campaign currently hosted on Cloudflare Pages. The page masquerades as a legitimate login portal while exfiltrating entered usernames and passwords to an attacker-controlled server. Victims risk immediate account takeover across any service for which they reuse credentials, enabling follow-on fraud, identity theft, or lateral movement within corporate environments. The risk level is elevated due to ongoing availability and the plausible appearance of the landing page.

This domain was flagged by exactly 1 of 95 VirusTotal scanners at time of analysis and resolves to IP address 188.114.96.3. It is registered through Cloudflare, Inc. and protected by a Google Trust Services SSL certificate, adding to its deceptive authenticity. The page is delivered via Cloudflare Pages, a legitimate platform abused for instant deployment and evasion of takedown efforts. No current blocklist entries were detected, allowing continued exposure to potential victims.

To mitigate exposure, users must avoid clicking links to live-web-ldgr.pages.dev or any derived URLs. Organizations should immediately block the domain at DNS/proxy layers and inspect proxy logs for recent hits. Employees who may have entered credentials should rotate passwords immediately and enable multi-factor authentication. Security teams can submit the IP 188.114.96.3 and domain to threat intelligence platforms for broader detection coverage. Always verify the authenticity of login portals by checking the exact domain and confirming HTTPS certificate issuer before entering credentials.