live-desktop-en-ledgor[.]pages[.]dev

PhishDestroy identifies the domain live-desktop-en-ledgor.pages.dev as hosting a fake desktop login phishing page designed to harvest user credentials. The threat type is categorized as generic_phishing, with the malicious infrastructure leveraging a branded fake desktop interface to deceive victims into entering sensitive login information. No specific drainer kit has been identified in this instance, but the page mimics legitimate desktop environments to increase the likelihood of credential theft.

This domain resolves to IP address 188.114.97.3 and is registered through Cloudflare, Inc. as confirmed by VirusTotal’s passive DNS records. The domain currently exhibits a VirusTotal detection score of 0 detections out of 95 engines, indicating it has not yet been widely flagged despite its malicious nature. The SSL certificate is issued by Google Trust Services, which may lend an air of legitimacy to the phishing page. Additional technical indicators include a recent creation date (specific date not disclosed in available data) and an under-investigation status in Google Safe Browsing (GSB).

The current status of this domain remains active, with no confirmed takedown actions recorded at this time. PhishDestroy flags this domain as a high-risk phishing threat due to its active campaign and lack of detections across major security engines. Immediate action is recommended to block this domain at the network level and update endpoint protection rules to detect similar fake desktop login pages. While the risk level is currently under investigation, the absence of detections suggests a need for heightened vigilance. Organizations are advised to monitor for user reports of credential compromise and to deploy DNS filtering to prevent access to this domain.