eng-ldgrrdekstop-learn[.]pages[.]dev

PhishDestroy identifies a newly active phishing domain, eng-ldgrrdekstop-learn.pages.dev, impersonating a Windows learning portal to steal credentials. This site currently shows zero detections out of 95 VirusTotal scans, meaning antivirus engines have not yet flagged it. The domain resolves to 172.66.45.33 and operates under Cloudflare’s infrastructure, leveraging a Google Trust Services SSL certificate for added credibility. This threat emerged through Cloudflare’s Pages service, a platform often abused by threat actors to host convincing decoy sites. With no detections recorded as of this analysis, the site may evade detection long enough to ensnare unsuspecting users seeking software tutorials or training material. It’s critical to treat any login prompt on this domain as a potential credential theft trap, especially those mimicking Microsoft or Windows-related services. If you visited eng-ldgrrdekstop-learn.pages.dev and entered any credentials, immediately change passwords on that site and all accounts using the same password. Scan your device with updated antivirus software and review financial or cloud accounts for suspicious activity. Report the domain to your security team and avoid future visits. Consider using password managers and multi-factor authentication to reduce risk if credentials were exposed.