faq-e-ledgr[.]pages[.]dev

The domain faq-e-ledgr.pages.dev has been identified as an active credential harvesting endpoint, specifically designed to deceive users into submitting sensitive login credentials under the guise of a legitimate FAQ or ledger service. While no prominent brand mimicry was observed in the available telemetry, the infrastructure aligns with common phishing drainer kits that exfiltrate credentials via spoofed forms. The threat actor leverages Cloudflare’s Pages.dev service for rapid deployment and evasion of traditional web filtering mechanisms, creating a false sense of trust through legitimate-looking subdomains and SSL certificates.

This domain resolves to the IP address 172.66.45.32 and is registered through Cloudflare, Inc. Security vendor analysis via VirusTotal indicates a detection rate of 5 out of 95 security engines, suggesting fledgling but not insignificant malicious activity. Notably, the domain was created recently and remains absent from Google Safe Browsing (GSB) and major threat intelligence blocklists at the time of analysis, indicating evasion tactics likely designed to bypass early-stage detection systems. The low detection rate underscores the stealthy nature of this campaign.

The domain is currently flagged as active and poses an elevated risk to organizations and individuals alike. While immediate responsive actions such as DNS blocking and IP reputation blacklisting are recommended, the domain’s utilization of Cloudflare infrastructure creates a persistent challenge for takedown efforts. Remaining risk is elevated due to the domain’s low detection footprint and potential for rapid domain rotation. Users should exercise caution when encountering links associated with this domain and verify all login portals through official channels. Organizations are advised to update firewall rules and SIEM signatures to detect and block communication with 172.66.45.32.