enga-ledgeir[.]pages[.]dev

PhishDestroy identifies enga-ledgeir.pages.dev as an active crypto drainer domain operating under Cloudflare Pages. The domain is currently impersonating a generic financial service, deploying a drainer script designed to siphon cryptocurrency assets from unsuspecting wallets. Infrastructure analysis suggests the threat actor is leveraging Cloudflare’s trusted Pages service to host the drainer kit, thereby evading traditional security filters that flag raw IP-based domains. No specific brand is being impersonated at this time, indicating a broader targeting approach aimed at capturing crypto users across various platforms.

Technical indicators reveal this domain was registered through Cloudflare, Inc., resolving to IP 172.66.47.195 with a Google Trust Services SSL certificate. VirusTotal currently reports zero detections (1/95) as of seed 9c1184, highlighting the evasive nature of this campaign. The domain’s rapid deployment via Cloudflare Pages contributes to its low detection footprint, while the underlying IP is part of Cloudflare’s CDN range, complicating takedown efforts. At this stage, the domain remains unlisted on major blocklists, including Google Safe Browsing.

This domain is marked as active and under investigation, with a current risk level of under_investigation. Immediate safety actions include blocking the domain and IP at both network and endpoint levels. Users should avoid clicking links to enga-ledgeir.pages.dev and verify the legitimacy of any financial service before interacting. The remaining risk is high due to the drainer’s active status, the low VT score, and the domain’s strategic hosting on a trusted platform. Organizations are advised to update threat intelligence feeds and firewall rules to include this indicator, while monitoring for additional domains hosted on the same infrastructure.