learn-lodzr-start[.]pages[.]dev

PhishDestroy has identified an active credential theft campaign targeting users through the domain learn-lodzr-start.pages.dev. This page is designed to mimic a legitimate login portal, tricking visitors into entering sensitive credentials such as usernames and passwords. The threat actor leverages Cloudflare Pages to host the phishing content, making it appear more credible while evading traditional detection methods. Users who interact with this page risk having their credentials harvested and exploited for further attacks, including account takeovers or financial fraud.

This domain was flagged after VirusTotal analysis returned 13 out of 95 detections, indicating no antivirus engines currently recognize it as malicious. The page is registered through Cloudflare, Inc., a common tactic among threat actors to obscure the true origin of phishing infrastructure. Cloudflare Pages allows for rapid deployment and easy customization of phishing content, often leading to short-lived but highly effective campaigns. The SSL certificate, issued by Google Trust Services, adds a false sense of legitimacy, as visitors may assume the site is secure due to the recognizable issuer.

If you visited learn-lodzr-start.pages.dev, do not enter any personal or login information. Check your accounts for suspicious activity, such as unauthorized logins or password changes, and enable multi-factor authentication (MFA) where possible. Report this domain to your IT security team or through platforms like PhishDestroy to help block its distribution. Avoid clicking links from unsolicited emails or messages, as these are common delivery vectors for such phishing pages. Stay vigilant and verify the legitimacy of websites before entering sensitive data.