ldgrers-live-download[.]pages[.]dev

This domain, ldgrers-live-download.pages.dev, operates as a credential harvesting phishing site designed to mimic legitimate login portals for financial or cryptocurrency services. Analysis of the page structure and redirect behavior indicates it targets users attempting to access account management interfaces, where it captures entered credentials through fraudulent input forms. The site employs social engineering tactics, including urgency-inducing language and cloned branding, to deceive victims into submitting sensitive authentication details. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 6, 2026, with an anomalous future creation date suggesting potential record manipulation. It resolves to IP address 172.66.46.217 and utilizes a Google Trust Services SSL certificate, providing a false sense of security. Despite appearing on one security blocklist and receiving a 0/100 trust score from Gridinsoft, the domain has evaded detection by major scanning engines, with VirusTotal reporting 0/95 detections at the time of analysis. The page title explicitly states 'Suspected phishing site | Cloudflare,' though this appears to be a default placeholder rather than an active warning. Users who visited ldgrers-live-download.pages.dev should immediately cease all interaction and assume credential compromise. Those who entered login details must reset passwords for all associated accounts, particularly financial services, using a secure device. Enable multi-factor authentication where available and monitor accounts for unauthorized transactions. The domain's current offline status does not preclude future reactivation, necessitating continued vigilance. Network administrators should block the IP address 172.66.46.217 and implement DNS filtering for the domain to prevent access attempts from organizational systems.