eng-us-desktop-ledger[.]pages[.]dev

eng-us-desktop-ledger.pages.dev is currently active and has been identified as a crypto‑drainer operation. The domain is hosted on Cloudflare’s network and resolves to the address 188.114.97.3. Registration details show the registrar as Cloudflare, Inc., with authoritative name servers nucum.ns.cloudflare.com and sri.ns.cloudflare.com. Threat‑intelligence feeds indicate that the domain has been blocked by the PhishDestroy sinkhole and is listed on a single external blocklist.

VirusTotal analysis reports 11 of 91 scanning engines flagging the host as malicious, confirming the presence of at least one known malware or phishing component. No additional metadata such as SSL certificate details, HTTP status codes, page title, or Safe Browsing verdicts were supplied, so the exact content and delivery mechanism remain unverified. The limited footprint suggests a low‑profile infrastructure that relies on Cloudflare’s CDN to obscure origin and to benefit from the service’s global edge network.

Defenders should treat any traffic to this hostname as hostile. Recommended actions include adding the domain and its resolving IP to DNS and firewall blocklists, updating web‑proxy filters with the observed indicators, and monitoring for similar “pages.dev” sub‑domains that use the “eng‑us‑desktop‑ledger” naming pattern. Continuous re‑scanning on VirusTotal and periodic checks of emerging blocklists are advised to capture any evolution of the campaign.