us-ledgrlive-desktop[.]pages[.]dev

PhishDestroy identifies a live credential-theft operation hosted at us-ledgrlive-desktop.pages.dev that mimics a legitimate desktop-login portal. The domain is actively resolving and presently categorized as an elevated risk by PhishDestroy’s phishing-intelligence pipeline. No specific brand is being impersonated in this campaign; instead, attackers are leveraging the LiveDesktop naming convention to harvest enterprise credentials under the guise of remote-desktop access.

This domain was flagged by 2 of 95 VirusTotal vendors and resolves to IP 172.66.47.160 via Cloudflare, Inc., the listed registrar. The Google Trust Services SSL certificate provides a deceptive veneer of legitimacy, but the low detection ratio and lack of established reputation indicate a freshly minted infrastructure designed for rapid abuse. Historical telemetry places the domain’s creation within the last thirty days, and public blocklists currently show zero detections, underscoring its novelty and the need for immediate, proactive blocking.

PhishDestroy recommends that enterprise security teams immediately block the domain and the underlying IP address at the network perimeter and DNS layers. Users who may have entered credentials should be instructed to rotate passwords immediately and enable multi-factor authentication across all services. Monitor authentication logs for anomalous login patterns originating from this infrastructure or any recently registered *.pages.dev subdomains. Consider deploying browser-based URL-reputation policies that flag newly observed domains with fewer than five VirusTotal detections to reduce dwell time.