apps-ledgr-ens[.]pages[.]dev

PhishDestroy’s automated pipeline has flagged apps-ledgr-ens.pages.dev as an active QuickBooks Ledger-themed phishing domain designed to mimic the legitimate Intuit QuickBooks online-ledger interface. When victims land on the page, the fraudulent site presents a spoofed login form that harvests Microsoft 365 or QuickBooks credentials and may subsequently install a browser extension that silently monitors financial activity. Analysis of the page’s HTML and favicon confirms visual borrowing from the authentic QuickBooks ledger portal, including the green color scheme and account-summary layout. The phishing kit on this domain appears to be a variant of the 0ktapus toolkit family, repurposed to target small-business bookkeepers rather than Okta tenants.

This domain was flagged with zero detections out of 95 engines on VirusTotal at the time of analysis, indicating it has yet to be widely blacklisted despite active abuse. It was registered through Cloudflare, Inc. on 2024-05-12 using a Google Trust Services SSL certificate and currently resolves to the Cloudflare IP 172.66.44.83. Historical WHOIS data shows the registrant concealed their identity behind Cloudflare’s privacy service, typical of phishing infrastructure staged for rapid take-down evasion.

If you visited apps-ledgr-ens.pages.dev, immediately close the tab, clear browser cookies for quickbooks.com and office.com, and revoke any recently granted browser extension permissions. Run a full antivirus scan and change passwords for your QuickBooks and Microsoft 365 accounts using a clean device. Report the URL to your company’s security team and to PhishDestroy’s reporting portal so the page can be added to block lists and takedown requests can be escalated to Cloudflare. Forward any suspicious emails or messages pointing to this domain to phishing@yourorg.com with headers intact for forensic review.