eng-ledxgeir[.]pages[.]dev

PhishDestroy identifies eng-ledxgeir.pages.dev as an active credential phishing campaign using a fraudulent login portal to harvest user credentials. The risk level remains under investigation, but the domain is explicitly designed to mimic trusted services to deceive victims into entering sensitive information. Malicious actors leverage Cloudflare Pages to host the phishing kit, which currently remains undetected by security engines and operates via a Google Trust Services SSL certificate. This domain was flagged through proprietary analysis and shows no detections on VirusTotal (1/95), operates on IP address 172.66.47.95, and is registered under Cloudflare, Inc. The domain is hosted on Cloudflare Pages, a legitimate service abused by threat actors to deploy phishing sites quickly. Despite utilizing a valid SSL certificate from Google Trust Services, which may increase user trust, the domain's sole purpose is to facilitate unauthorized credential collection. Current blocklist status and trust scores remain unverified due to the domain's recent emergence and low detection rate. To mitigate exposure to this threat, users should avoid interacting with eng-ledxgeir.pages.dev entirely. Organizations can block the domain at DNS and network levels using the provided IP and domain. Security teams are advised to monitor for inbound connections to 172.66.47.95 and inspect SSL certificate validation failures involving Google Trust Services for similar artifacts. Immediate credential rotation and two-factor authentication checks are recommended for any users who may have entered information. Report this domain to Cloudflare Trust & Safety and relevant threat intelligence platforms.