ledhggt-vbhdgg[.]pages[.]dev

This domain, ledhggt-vbhdgg.pages.dev, is identified as a credential harvesting operation designed to deceive users into submitting login credentials, payment details, or other sensitive information. Analysis indicates the site employs generic phishing tactics without clear attribution to a specific brand or drainer kit, suggesting a broad, opportunistic attack vector. The infrastructure lacks overt branding, increasing the likelihood of impersonation across multiple targets rather than a single high-value entity. Infrastructure analysis reveals critical technical indicators: the domain resolves to IP address 188.114.97.3, hosted under a content delivery network provider in Canada. It was registered on April 09, 2026, through a domain registrar known for rapid deployment of ephemeral phishing sites. Security vendor detections on VirusTotal report 18/95 engines flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate, issued by a widely trusted certificate authority, uses the E7 intermediate chain, a common choice for both legitimate and fraudulent sites to bypass initial browser warnings. No Google Safe Browsing (GSB) listing was observed at the time of assessment. The domain is currently offline, likely due to takedown actions by the hosting provider or security teams. Despite its inactive status, residual risk persists for users who may have interacted with the site prior to its removal. Historical DNS records and cached content could still pose threats if accessed through local browser caches or archived web pages. Users are advised to verify any credentials entered on this domain as compromised, reset passwords for associated accounts, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its resolved IP to prevent future access attempts.