eng-ledg-desk[.]pages[.]dev

PhishDestroy identifies eng-ledg-desk.pages.dev as a live phishing domain currently under investigation for generic phishing attacks. This domain mimics legitimate financial or ledger services to harvest user credentials or sensitive data. The threat remains active as of the latest monitoring cycle.

This domain was flagged by 5 of 95 VirusTotal vendors despite resolving to IP address 172.66.44.67 (Cloudflare-hosted). It operates under Google Trust Services SSL, leveraging reputable infrastructure to evade detection. The domain is registered through Cloudflare, Inc., a common tactic among threat actors to mask origin and prolong operational uptime.

Users are strongly advised to block access to eng-ledg-desk.pages.dev immediately and avoid entering any login or payment details. Organizations should add this domain and its resolved IP to firewall blocklists and scan internal networks for callbacks. Report the domain to your security provider and consider submitting to threat intelligence feeds to prevent further propagation. Monitor for related domains using the unique seed identifier 519f9f for cross-referencing.