faq-legr-live-czw[.]pages[.]dev

Analysis conducted on July 29, 2026 identifies faq-legr-live-czw.pages.dev as an active phishing domain hosted on Cloudflare Pages infrastructure. The domain is flagged by 5 of 91 security vendors on VirusTotal, indicating detection by multiple engines, though the specific signatures or heuristics triggering these alerts are not disclosed in available data. It appears on at least one security blocklist, specifically PhishDestroy, which has classified this domain as malicious. The domain resolves to the IP address 188.114.97.3, a Cloudflare-operated endpoint, and utilizes Cloudflare nameservers (fiona.ns.cloudflare.com and robert.ns.cloudflare.com).

Registration details confirm Cloudflare, Inc. as the registrar, consistent with the hosting provider. No brand target, phishing kit, or specific scam category (e.g., credential harvesting, payment fraud, or crypto-related) has been confirmed in the available intelligence. The exact content of the phishing page remains unanalyzed; no page title, HTTP response code, or SSL certificate details are provided in the current dataset.

Defenders should treat this domain as an elevated-risk phishing resource due to its presence on blocklists and vendor detections. Network-level blocking at the domain and IP level (188.114.97.3) is recommended, along with monitoring for related subdomains or redirect chains leveraging the same Cloudflare Pages infrastructure. Further investigation into the domain's traffic sources, associated email campaigns, or payload delivery mechanisms is advised to determine the full scope of the threat.