desktop-live-ledor[.]pages[.]dev

PhishDestroy identifies desktop-live-ledor.pages.dev as an active phishing domain hosting a generic fake login page designed to harvest user credentials under investigation. This domain is not currently impersonating a specific brand but employs a decoy login interface to trick victims into submitting sensitive information such as usernames and passwords. The infrastructure and layout suggest the use of a standard phishing kit optimized for credential theft, potentially targeting unsuspecting users under the guise of a legitimate service or platform.

Technical indicators associated with this domain include a VirusTotal detection score of 9/95, indicating no antivirus or security vendor has flagged it as malicious as of current analysis. The domain is registered through Cloudflare, Inc., leveraging their proxy and security services, and resolves to IP address 188.114.96.3. It holds a valid SSL certificate issued by Google Trust Services, which may help it evade detection by appearing legitimate. No historical blocklist data is available, and the domain’s registration and operational timeline remain under close scrutiny for additional threat intelligence.

This domain remains active with a status classified as under_investigation, reflecting ongoing forensic analysis by PhishDestroy. No official blocklist inclusion has been applied yet despite the known risks. Users are strongly advised to avoid interacting with desktop-live-ledor.pages.dev and to validate any suspicious links using PhishDestroy’s verification tools. The current risk level is classified as high due to the confirmed presence of a credential harvesting mechanism and the absence of widespread detection across security platforms.