eng-ledgrrlive[.]pages[.]dev

PhishDestroy identifies eng-ledgrrlive.pages.dev as an active generic phishing domain currently under investigation for hosting a crypto drainer scheme. The threat involves a fraudulent webpage designed to trick users into connecting cryptocurrency wallets under false pretenses, leading to unauthorized fund transfers. As of the latest assessment, the domain remains in an active status with no confirmed takedown or remediation applied. PhishDestroy's analysis reveals that eng-ledgrrlive.pages.dev is registered through Cloudflare, Inc., resolving to IP address 172.66.44.98 and secured with a Google Trust Services SSL certificate. The domain has not yet been flagged by any of the 95 VirusTotal vendors, indicating a low detection rate despite its malicious nature. Additional telemetry shows zero detections on multiple threat intelligence platforms, suggesting this campaign may be newly deployed or carefully evading traditional signature-based detection mechanisms. The domain's infrastructure and certificate issuance align with legitimate Cloudflare Workers deployments, which complicates quick identification by automated scanners. The current status of eng-ledgrrlive.pages.dev remains active, with no observable changes in its abuse profile over the past 48 hours. Given the absence of vendor detections, users are strongly advised to avoid any interaction with this domain, particularly any prompts involving cryptocurrency wallet connections or login credentials. PhishDestroy recommends verifying all suspicious domains through its database before engagement. Users who may have already interacted with this site are urged to revoke any connected wallet permissions immediately and transfer remaining funds to a clean wallet. Security teams should monitor this domain for evolving payloads and update blocklists accordingly.