ledgcom-eng-us[.]pages[.]dev

PhishDestroy identifies ledgcom-eng-us.pages.dev as an active generic phishing domain. The threat involves impersonation tactics targeting unsuspecting users under the guise of legitimate financial or engagement platforms. Current evidence suggests this campaign is operational and distributing deceptive content through social engineering lures, likely involving fake login portals or credential harvesting pages.

This domain was flagged by 12 of 95 VirusTotal vendors, indicating a low detection rate despite its malicious intent. The domain is registered through Cloudflare, Inc., resolving to IP address 172.66.47.148. The SSL certificate is issued by Google Trust Services, which may contribute to its perceived legitimacy. While specific creation and blocklist data are pending further analysis, the absence of detections highlights the evasive nature of this campaign. The use of a Google Trust Services SSL certificate suggests an attempt to bypass traditional security filters by leveraging trusted certificate authorities.

The current status of this campaign remains active, with no detections on VirusTotal and minimal observable blocklisting. Organizations and users should treat this domain as a high-risk threat due to its active distribution and low detection rate. Immediate action includes blocking the domain at the network and endpoint levels, updating threat intelligence feeds, and conducting employee awareness training to mitigate the risk of credential theft or financial fraud. PhishDestroy recommends isolating any systems that may have interacted with this domain and conducting forensic analysis to assess potential compromise. Users should verify the authenticity of any unsolicited communications referencing financial or engagement platforms and avoid entering credentials on untrusted pages.