eng-ledgeirlive[.]pages[.]dev

PhishDestroy identifies eng-ledgeirlive.pages.dev as an active credential theft phishing domain under investigation. This Pages.dev-hosted threat impersonates legitimate services to harvest user credentials, presenting a significant risk to unsuspecting visitors. The domain’s recent activation and low detection rates warrant immediate scrutiny as it may evade traditional security measures. This domain resolves to IP 188.114.97.3, registered through Cloudflare, Inc. with a Google Trust Services SSL certificate. VirusTotal currently shows 3/95 detections, indicating negligible detection at the time of analysis. The Pages.dev platform, leveraged for hosting, is legitimate but frequently abused by threat actors for phishing campaigns due to its ease of deployment and masking capabilities. No blocklist entries were detected in public feeds at investigation time, and the domain’s recent creation suggests an opportunistic campaign targeting users seeking quick access to purported services. Mitigation against credential theft phishing like this requires layered defenses. Network administrators should block the domain and its resolving IP at the firewall level. Users should verify URLs before inputting credentials and enable multi-factor authentication on all accounts. Security teams are advised to monitor for exfiltrated credentials on dark web forums and update threat intelligence feeds with these indicators. Immediate takedown requests should be filed with Cloudflare and the hosting provider to disrupt the campaign.