live-ldger-app-us[.]pages[.]dev

PhishDestroy identifies a recently activated phishing domain, live-ldger-app-us.pages.dev, impersonating a Google Pages service to harvest user credentials and financial data. This threat uses a deceptive subdomain structure under pages.dev to appear legitimate while redirecting victims to fake login portals. The domain currently resolves to IP 188.114.96.3, a Cloudflare-hosted address that may shift rapidly to evade detection. This domain exhibits concerning operational security practices, registering through Cloudflare, Inc. with Google Trust Services SSL certificates—both services legitimate in isolation but weaponized here. VirusTotal analysis confirms 2/95 security vendors have flagged the domain despite active phishing campaigns, with no blocklist entries recorded. The combination of trusted infrastructure and zero detections represents a sophisticated threat actor leveraging cloud services to bypass traditional security measures. Users who visited this domain should immediately change passwords for any accounts entered at the site, enable multi-factor authentication on all sensitive accounts, and scan their devices for malware. Report the domain to your security team and file abuse complaints with Cloudflare and Google Trust Services. Monitor financial accounts for unauthorized transactions and consider implementing DNS sinkholing to prevent further access. This threat remains under active investigation as the domain continues to evolve countermeasures against detection.