access-ledgr-s-entart[.]pages[.]dev

PhishDestroy identifies active credential phishing infrastructure targeting enterprise users via access-ledgr-s-entart.pages.dev, a page hosted on Cloudflare Pages resolving to IP 172.66.47.182. The domain leverages a Google Trust Services SSL certificate to appear legitimate while delivering a generic phishing drainer kit designed to harvest corporate login credentials. No specific brand is mimicked in the observed payload, suggesting opportunistic targeting of business users. This constitutes a direct risk to organizational security through unauthorized access and data exfiltration.

This domain was flagged with a current VirusTotal detection score of 10/95 as of the latest scan, indicating zero antivirus engines have flagged the malicious content. It is registered through Cloudflare, Inc. and resolves to IP address 172.66.47.182. The SSL certificate is issued by Google Trust Services, which is commonly abused in phishing campaigns to establish trust. The seed identifier 780497 confirms this as a tracked active campaign under investigation, with no confirmed blocklist presence at this stage.

The threat remains active with an under_investigation status as of seed 780497. Immediate response actions include blocking the domain access-ledgr-s-entart.pages.dev and IP 172.66.47.182 at the network perimeter, disabling access to Cloudflare Pages-hosted content where possible, and conducting user awareness training to prevent credential submission. While the risk is currently elevated due to zero detections and active hosting, blocking these indicators will mitigate immediate exposure. Users are advised to verify all login pages and report any suspicious credential prompts to security teams immediately.