eng-suits-ei[.]pages[.]dev

PhishDestroy identifies eng-suits-ei.pages.dev as an active fake login portal designed to harvest credentials under the guise of a business service. This domain masquerades as a legitimate site, luring users to input sensitive login information which is then exfiltrated by the attackers. The threat is immediate, as victims risk account takeovers, financial fraud, or corporate espionage depending on the credentials exposed. This campaign specifically targets users expecting a professional interface, exploiting trust in recognizable branding or services.

Evidence confirms this domain’s malicious nature: VirusTotal shows 1/95 detections, indicating it has evaded detection by current security engines. Registered through Cloudflare, Inc., it resolves to IP 172.66.47.71 and operates under a Google Trust Services SSL certificate, which may falsely reassure users. The domain’s pages.dev subdomain suggests rapid deployment, a common tactic for phishing campaigns seeking to exploit legitimate cloud services. With no blocklist flags yet, the window for proactive defense remains critical.

If you visited eng-suits-ei.pages.dev, assume your credentials were compromised. Immediately change passwords for any accounts entered on this site, enable multi-factor authentication (MFA) on all related accounts, and scan devices for malware. Report the domain to your security team or phishing response platforms. Block the domain and IP (172.66.47.71) at your network perimeter to prevent further access. Monitor accounts for unusual activity and warn colleagues or contacts who may have interacted with this site. Proactive blocking and credential hygiene are essential to mitigate potential fallout from this campaign.