desktp-ledglivee-eng[.]pages[.]dev

PhishDestroy identifies desktp-ledglivee-eng.pages.dev as an ACTIVE phishing domain currently under investigation for targeting desktop users through generic phishing tactics. This domain employs deceptive tactics to mimic legitimate services, likely aiming to harvest credentials or financial data. No specific brand impersonation or drainer kit has been confirmed at this stage, though the page structure suggests a standard credential-harvesting approach. The domain is hosted on Cloudflare Pages and utilizes a Google Trust Services SSL certificate to appear legitimate.

Technical indicators confirm elevated risk: VirusTotal shows 8/95 security engines detecting malicious content as of the latest scan. The domain resolves to IP address 188.114.96.3 via Cloudflare's infrastructure. Registered through Cloudflare, Inc., this site exhibits recent creation with no prior reputation in Google Safe Browsing (GSB) systems. Current blocklist aggregation shows zero detections across major threat intelligence platforms, indicating a newly emerged threat with minimal exposure.

This domain remains ACTIVE with an UNDER_INVESTIGATION status. Immediate deceptive nature is confirmed but requires deeper forensic analysis to determine full operational scope. PhishDestroy recommends immediate user avoidance and enterprise blocking of both the domain and IP address 188.114.96.3. Remaining risk is classified as HIGH due to active deployment, recent emergence, and absence of detection signatures. Continuous monitoring and proactive threat hunting are advised until full IOCs are established and distributed.