en-us-ledrdesktop[.]pages[.]dev

PhishDestroy identifies en-us-ledrdesktop.pages.dev as a currently active phishing domain masquerading as a fake Windows desktop environment to deceive users into downloading malicious software or entering sensitive credentials. The site is flagged by PhishDestroy as a browser locker phishing attack, designed to lock browsers in full-screen mode and display fake system warnings to pressure victims into calling fake support lines or downloading rogue installers. This domain is under active investigation as of March 2025.

This domain resolves to IP address 188.114.97.3 and is hosted on Cloudflare infrastructure. The domain is registered through Cloudflare, Inc. as the registrar. VirusTotal currently shows a clean scan with 0 detections out of 95 security vendors, indicating a potential zero-day or recently deployed campaign. The domain uses a Google Trust Services SSL certificate, which does not validate trustworthiness of the site's content. As of the time of analysis, the domain is active and participating in phishing activities targeting English-speaking users seeking Windows system support.

Given the site's active status and deployment of browser locker tactics, the risk level remains under investigation but carries HIGH potential for user deception and credential compromise. Users are advised to block access to en-us-ledrdesktop.pages.dev at the network level. Organizations should update endpoint protection rules to flag executable downloads from this domain or its associated IP space. Users encountering this domain should avoid interaction, close the browser tab, clear cached data, and report the incident to their IT security team or through official phishing reporting channels. Continuous monitoring of this domain is warranted due to its low detection rate and active exploitation.