eng-leger-hub[.]pages[.]dev

PhishDestroy identifies eng-leger-hub.pages.dev as a recently activated crypto drainer domain impersonating a generic financial or logistics service, currently under investigation for malicious intent. This domain leverages Cloudflare’s Pages platform to host a browser-based cryptocurrency drainer designed to siphon tokens from connected wallets during transaction approvals. While no specific brand is directly impersonated in the URL, the inclusion of 'leger' (likely referencing ledger or logistics) suggests a potential decoy aimed at users seeking financial tools or services. The drainer kit appears to be in active deployment, with indicators suggesting it may utilize obfuscated JavaScript to intercept wallet approvals and transfer permissions without explicit user consent.

Technical analysis of eng-leger-hub.pages.dev reveals concerning operational security weaknesses despite its active status. The domain was registered via Cloudflare, Inc., which provides anonymity and reduces traceability, with the site resolving to IP address 172.66.44.238. The domain is secured with a Google Trust Services SSL certificate, a tactic commonly used to establish false trust. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating it remains undetected by most antivirus platforms. While the exact creation date is not publicly disclosed due to Cloudflare’s privacy protections, the domain is currently active and unlisted on major blocklists including Google Safe Browsing and PhishTank at the time of analysis.

This domain is flagged with a status of 'active' and 'under_investigation,' signaling ongoing monitoring by cybersecurity teams. Immediate risks include potential financial loss for users who interact with the site, particularly those engaging in cryptocurrency transactions or wallet connections. Security teams are advised to block eng-leger-hub.pages.dev at the network and DNS levels and to monitor for related subdomains or IP clusters. Users are strongly urged to avoid visiting the domain, verify any financial services URLs via official sources, and use hardware wallets or transaction simulation tools before approving transfers. The remaining risk is evaluated as high due to the drainer’s operational capacity, low detection rate, and the irreversible nature of cryptocurrency theft.