lejjar-live-desktop[.]pages[.]dev

PhishDestroy identifies the active domain lejjar-live-desktop.pages.dev as a generic phishing page impersonating a widely used desktop service. The page was flagged under unique seed 04c6ba and is classified as an under-investigation threat. Initial analysis suggests a credential-harvesting scheme targeting users who may confuse the Cloudflare Pages URL with an official service. No known drainer kit signatures were detected during the first assessment, but the page’s behavior aligns with common web-based credential theft campaigns.

Technical indicators confirm the following: the domain resolves to IP address 188.114.97.3 and is registered through Cloudflare, Inc. VirusTotal scans currently show 4 out of 95 detection engines flagging the page, indicating it remains under the radar of most security platforms as of analysis time. The domain utilizes a Google Trust Services SSL certificate, enhancing its appearance of legitimacy. While the exact creation date is not provided in available telemetry, the domain is confirmed active and serving content. It is not currently blocked by Google Safe Browsing (GSB) nor appear on major public blocklists, leaving users directly exposed.

The domain status is active and under investigation, with no confirmed takedown or blocking implemented by hosting or registrar at this time. PhishDestroy recommends users avoid accessing lejjar-live-desktop.pages.dev and treat any login prompts as highly suspicious. Organizations are advised to block the IP 188.114.97.3 and monitor for outbound connections to this address. Remaining risk is moderate due to low detection rates and absence of active blocking, highlighting the need for heightened user vigilance and immediate reporting of any encountered samples. Users should verify URLs carefully, use multi-factor authentication, and consult official sources before entering credentials.