io-ldger-starr[.]pages[.]dev

PhishDestroy identifies io-ldger-starr.pages.dev as a credential theft domain currently active in the wild, masquerading as a legitimate service to harvest user login data. Hosted behind Cloudflare at 188.114.97.3, the infrastructure leverages Google Trust Services SSL to lend false legitimacy while avoiding detection—currently undetected by 95 antivirus engines on VirusTotal. Despite its clean scan, this domain’s suspicious construction and lack of historical reputation make it a prime vector for web-based credential harvesting and potential crypto wallet draining. The domain’s technical profile reveals elevated risk despite low detection scores. It resolves to 188.114.97.3, a Cloudflare IP, and is registered through Cloudflare, Inc., which often obscures true ownership. VirusTotal analysis shows zero detections out of 95 engines as of the latest scan using seed b5e977, underscoring how new or evasive this threat remains. While SSL certificates from Google Trust Services can signal legitimate use, attackers frequently abuse trusted issuers to bypass browser warnings. The absence of prior blocklist entries suggests this domain may be freshly deployed or rapidly cycling through Cloudflare’s infrastructure to evade takedown efforts. Users who visited io-ldger-starr.pages.dev should immediately audit their browser history and disable any saved credentials associated with the site. Reset passwords for affected accounts using a secure device and enable two-factor authentication where possible. Scan the device that accessed the domain with updated antivirus and anti-malware tools to detect any payloads or browser extensions that may have been installed covertly. Report the domain to your security team and consider blocking 188.114.97.3 at the network perimeter. Remain vigilant for unusual cryptocurrency transfer requests or unauthorized login attempts in the coming days.