faq-ledgrwalite-eng[.]pages[.]dev

PhishDestroy identifies active phishing activity on the domain faq-ledgrwalite-eng.pages.dev associated with a generic phishing campaign. The domain is currently under investigation and classified under threat type 'generic_phishing' with a status of 'active'. Initial analysis suggests the domain impersonates legitimate FAQ pages to deceive users into entering sensitive information.

This domain was flagged by 1 of 95 VirusTotal vendors as of the investigation seed 7cb579. It resolves to IP address 172.66.44.137 and is registered through Cloudflare, Inc. The domain operates under an SSL certificate issued by Google Trust Services, leveraging HTTPS to appear legitimate. Despite its low detection rate, the combination of new registration, Cloudflare hosting, and low VirusTotal detections warrants heightened scrutiny.

PhishDestroy assesses this domain as an emerging threat with potential for escalation in detection rates as additional intelligence is gathered. Users are advised to avoid interacting with faq-ledgrwalite-eng.pages.dev, particularly if prompted for login credentials or personal information. Security teams should block this domain at the network level and monitor for associated indicators of compromise. The current recommendation is to treat this domain as hostile until further analysis confirms its status.