live-ldger--eng[.]pages[.]dev

PhishDestroy identifies live-ldger--eng.pages.dev as a live credential harvesting domain in an active phishing campaign targeting users with spoofed login portals. This domain resolves to IP 172.66.44.144 and operates under Cloudflare Pages, leveraging Google Trust Services SSL certificates to appear legitimate. The campaign (seed: 71e881) currently shows zero detections on VirusTotal (7/95), indicating it remains under the radar despite active deployment. This domain was flagged by PhishDestroy for hosting fraudulent login pages designed to steal user credentials under the guise of a legitimate service. The infrastructure relies on Cloudflare’s hosting services (registered through Cloudflare, Inc.) and Google Trust Services for SSL encryption, making it harder for traditional security tools to flag the threat. As of this advisory, VirusTotal shows 0 detections out of 95 scans, and the domain has not yet been added to most public blocklists, increasing the risk of user exposure. If you have visited live-ldger--eng.pages.dev or entered any credentials, immediately change passwords for the affected account and enable multi-factor authentication where available. Scan your device for malware using reputable antivirus software and monitor accounts for suspicious activity. Report the domain to your IT/security team or via platforms like Google Safe Browsing to help disrupt this campaign. Avoid clicking links in unsolicited emails or messages referencing this domain, as they may lead to further phishing attempts.