dasktop-live-ladgr[.]pages[.]dev

PhishDestroy identifies dasktop-live-ladgr.pages.dev as a drainer-as-a-service phishing kit deployed on Pages.dev. The infrastructure leverages Cloudflare's Pages platform to host a phishing page mimicking a legitimate desktop service, likely targeting corporate login credentials. No specific brand spoofing was observed in preliminary analysis, but the generic nature of the domain suggests opportunistic credential harvesting.

Domain technical indicators include a 12/95 detection rate on VirusTotal as of the latest scan, resolving to IP 188.114.96.3 via Cloudflare, Inc. registration. The domain utilizes a Google Trust Services SSL certificate, indicating an attempt to establish legitimacy. While the exact creation date remains unverified, the absence of detections suggests recent deployment or evasion tactics. This domain has not been flagged by Google Safe Browsing (GSB) despite its malicious infrastructure, contributing to its elevated risk profile. Current blocklist coverage is minimal, with no significant enterprise or public blocklists flagging the domain at this time.

This domain remains active and poses a high risk of credential theft through socially engineered lures. Immediate action includes implementing network-level blocks for IP 188.114.96.3 and domain-level blocks for dasktop-live-ladgr.pages.dev. Users should avoid interaction with this domain entirely. Remaining risk includes potential DNS or infrastructure changes to evade detection, requiring ongoing monitoring. Organizations are advised to update firewall rules and endpoint protection lists to mitigate exposure.