service-en-ledgrcomio[.]pages[.]dev

PhishDestroy identifies service-en-ledgrcomio.pages.dev as an active generic phishing domain designed to steal user credentials under the guise of a legitimate service. This domain is not affiliated with any recognized brand and appears to leverage Cloudflare Pages for hosting, which may lend it an air of legitimacy to unsuspecting users. No specific drainer kit or malware payload has been publicly documented for this domain at this time, suggesting it is currently operating as a credential harvesting page, likely mimicking a login portal for a widely used service to maximize potential victims.

Technical analysis reveals this domain was registered through Cloudflare, Inc. and resolves to IP address 172.66.44.164. VirusTotal analysis shows 11 out of 95 security vendors flagged this domain as malicious, indicating a moderate yet concerning detection rate. The domain holds a valid SSL certificate issued by Google Trust Services, which may further deceive users into believing the site is secure. As of the latest intelligence, the domain’s creation date and blocklist count remain undisclosed, but the presence of an SSL certificate and Cloudflare hosting underscores the need for heightened vigilance.

The domain remains active and poses an elevated risk to users who may encounter it through phishing emails, malicious ads, or compromised websites. Users are advised not to interact with this domain or any associated links. PhishDestroy recommends blocking the domain at the network level and updating browser-based blocklists to prevent access. While the immediate risk is elevated, the domain’s reliance on Cloudflare Pages and SSL certificates suggests it may be part of a short-lived campaign. However, users should remain cautious and report any encounters with this domain to their IT security teams or through trusted phishing reporting platforms to aid in broader threat intelligence sharing.