ledgeer-live-deskt[.]pages[.]dev

PhishDestroy identifies active credential harvesting activity linked to ledgeer-live-deskt.pages.dev, a Cloudflare-hosted domain resolving to 172.66.47.176. This campaign specifically targets users under the guise of providing desktop access or related services, luring victims into submitting sensitive login credentials. The threat is classified as active and under investigation due to its potential to compromise corporate, financial, or personal accounts. Users interacting with this domain risk unauthorized access, data theft, or follow-on attacks such as account takeover or malware delivery. The domain is served over HTTPS with a valid SSL certificate issued by Google Trust Services, increasing its appearance of legitimacy and lowering user suspicion.

This domain was flagged by PhishDestroy after analysis revealed zero detections on VirusTotal (2/95 engines as of latest scan), zero current blocklist presence, and registration through Cloudflare, Inc. The infrastructure is hosted on Cloudflare's Pages platform, a legitimate service often abused in short-lived phishing campaigns due to its free tier and rapid deployment capabilities. The domain shows no prior reputation, suggesting recent creation and evasion of traditional security controls. The absence of detections highlights the need for behavioral monitoring over signature-based detection, as threat actors constantly adapt to bypass automated scans.

Users who have visited ledgeer-live-deskt.pages.dev or entered credentials must immediately change passwords for any accounts used on the site, enable multi-factor authentication where available, and monitor accounts for unusual activity. Do not reuse passwords across services. If credentials were entered, consider the compromise of related email accounts and watch for follow-on spear-phishing attempts. Report the domain to your security team and block it at the network and DNS levels using the IP 172.66.47.176 and domain ledgeer-live-deskt.pages.dev. Advise others in your organization to avoid interaction. This campaign is likely part of a broader operation targeting desktop service impersonations; vigilance and user awareness training remain critical defenses.