en-briidge[.]pages[.]dev

PhishDestroy identifies a recently active phishing campaign targeting bridge payment users via the domain en-briidge.pages.dev. This domain is masquerading as a legitimate payment portal, likely attempting to harvest financial credentials under false pretenses. Security researchers assess this as a high-priority threat due to its active status and evasion of current detection systems. This domain was flagged by PhishDestroy with 2 out of 95 VirusTotal engines detecting malicious activity as of the latest scan. The domain is registered through Cloudflare, Inc. and resolves to IP address 172.66.44.227. Notably, it uses a Google Trust Services SSL certificate to appear legitimate. The infrastructure suggests an attempt to exploit free hosting and trusted certificate authorities to bypass security measures. If you have visited en-briidge.pages.dev, immediately cease any input of financial or personal information. Disconnect from the site and scan your device for malware. Report the domain to your financial institution and change passwords for any accounts exposed during the session. Users should also block the domain at the network level and monitor financial statements for unauthorized transactions. Exercise heightened caution with unsolicited payment links and verify domains before entering sensitive data.