support--live-desktop-ledgr[.]pages[.]dev

PhishDestroy identifies the active crypto drainer impersonation domain support--live-desktop-ledgr.pages.dev. This domain is currently engaged in credential theft campaigns targeting unsuspecting users through brand impersonation tactics. The threat remains under formal investigation by threat intelligence teams, with confirmed malicious activity observed in real-world phishing lures distributed via social engineering vectors. This domain was flagged by 10 of 95 VirusTotal vendors as of the latest scan, indicating a lack of immediate signature-based detection despite its malicious nature. The domain resolves to IP address 172.66.44.156 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, leveraging the perceived legitimacy of trusted providers to evade user suspicion. The landing page associated with this domain has not yet been added to major threat intelligence blocklists, including PhishTank or OpenPhish, further prolonging its window of operation. PhishDestroy advises all users to immediately block outbound connections to this domain at the network perimeter and to refrain from visiting the URL under any circumstances. Users who have recently interacted with this domain or entered credentials should assume compromise and initiate account recovery procedures with affected platforms. Security teams are encouraged to monitor DNS queries for this domain and scan endpoints for indicators of compromise associated with its infrastructure. This campaign is evolving, and additional IOCs will be published as they are identified. Proactive threat hunting is strongly recommended to mitigate potential asset loss.