en-us-ledgeeapps-eng[.]pages[.]dev

PhishDestroy identifies the domain en-us-ledgeeapps-eng.pages.dev as a generic phishing infrastructure node currently under active investigation for hosting fraudulent content. This domain is flagged for impersonating legitimate mobile application login interfaces, posing as a spoofed app store or service portal. The current status remains active, with no confirmed takedown as of seed 93f753. This domain was flagged by 9 of 95 VirusTotal vendors, registered through Cloudflare, Inc., and resolves to IP address 172.66.44.235. The SSL certificate is issued by Google Trust Services. Key technical indicators include deployment on a free Pages.dev subdomain, suggesting opportunistic abuse of reputable hosting providers. Despite zero detections on VirusTotal, the lack of brand-specific targeting and use of a dynamic hosting service (Cloudflare Pages) raises red flags for generic credential harvesting campaigns. The current status remains active, with no confirmed blocklist inclusion at the time of analysis. Users are advised to avoid visiting or interacting with this domain due to the elevated risk of credential theft or malware exposure. Security teams should monitor for further domain permutations and consider adding en-us-ledgeeapps-eng.pages.dev to network blocklists. Immediate actions include verifying user credentials exposed to this domain and conducting forensic analysis of any submitted data.