leger-desktop-app[.]pages[.]dev

PhishDestroy identifies the domain leger-desktop-app.pages.dev as an active fake desktop application phishing campaign. This threat is currently under investigation but remains operational as of the latest analysis.

This domain was flagged due to its malicious intent, with key indicators including zero detections out of 95 VirusTotal scans (1/95), registration through Cloudflare, Inc., and resolution to IP address 188.114.96.3. The domain operates under a Google Trust Services SSL certificate, which may be used to lend false legitimacy to the phishing site. No historical blocklist entries were detected during initial scans.

Mitigation steps for this fake desktop app phishing threat include blocking the domainleger-desktop-app.pages.dev at the network level, flagging the IP 188.114.96.3 in firewall rules, and warning users against downloading or interacting with desktop application installers from unverified sources. Organizations should also inspect internal DNS logs for recent resolutions to this domain and conduct user awareness training to highlight the risks of fake software installers.