best-ldger-us[.]pages[.]dev

PhishDestroy identifies the domain best-ldger-us.pages.dev as an active credential theft phishing campaign impersonating financial ledger services. The threat type has been classified as generic_phishing targeting unsuspecting users under the guise of a legitimate financial tool. This domain is currently active and under active investigation by PhishDestroy's threat intelligence team.

This domain was flagged by 3 of 95 VirusTotal vendors, indicating a low initial detection rate despite its malicious intent. Registered through Cloudflare, Inc., the domain resolves to IP address 172.66.47.85 and utilizes a Google Trust Services SSL certificate for added legitimacy. The domain is hosted on Pages.dev, a Cloudflare Pages platform, which may be leveraged to evade traditional email security filters. Due to its recent deployment, the domain has not yet been added to major blocklists, maintaining a high trust score among automated systems.

The current status of best-ldger-us.pages.dev remains active, posing an imminent risk to users who may interact with the fraudulent login portal. PhishDestroy recommends immediate blocking of the domain at the network and DNS levels to prevent further compromise. Users should verify the authenticity of financial ledger services through official channels and report any encountered phishing attempts to their IT security teams. Enhanced monitoring of outbound traffic to this domain is advised to mitigate potential data exfiltration.