home-eng-liveledgr[.]pages[.]dev

PhishDestroy identifies home-eng-liveledgr.pages.dev as a live Google Docs credential harvesting page actively distributing fake login prompts. This Cloudflare-hosted site (IP: 172.66.44.166) carries a Google Trust Services SSL certificate to mimic legitimate Google infrastructure, tricking users into surrendering sensitive account credentials. The domain’s .pages.dev TLD further exploits trust in Google’s Pages platform to bypass traditional security filters. Technical analysis reveals this domain remains undetected by security engines, scoring 5/95 on VirusTotal at the time of investigation. Registered through Cloudflare, Inc. with no publicly available creation date, the site operates under Cloudflare’s anonymizing proxy to obscure its true origin and hosting details. Independent threat intelligence feeds currently show no blocklist entries for this domain, highlighting its recent activation and the lag time in threat intelligence updates. If you or your organization encountered this domain, immediately revoke any credentials entered, enable two-factor authentication on all related accounts, and scan devices for malicious artifacts using reputable security software. Report the incident to your IT security team and consider blocking the domain (172.66.44.166) at the network perimeter. Monitor accounts for unusual activity and remain vigilant for follow-on credential phishing attempts disguised as legitimate services.