legion-apple-valley-mn[.]pages[.]dev

PhishDestroy identifies active Apple Gift Card phishing site legion-apple-valley-mn.pages.dev resolving to IP 188.114.96.3, flagged as generic_phishing under investigation with 1/95 VirusTotal detections. This .pages.dev subdomain mimics Apple’s branding to extort payment through counterfeit gift card redemption schemes. Registrant anonymized via Cloudflare and SSL certified by Google Trust Services, indicating advanced evasion tactics. Risk level under investigation with no blocklist presence yet, but low-detection hosting suggests rapid deployment cycles. Users encountering this domain risk financial theft or credential harvesting under the guise of free Apple product offers. This domain was flagged by seed d144d7 with technical indicators including VirusTotal 1/95 detections, Google Trust Services SSL certificate, Cloudflare registration, and IP 188.114.96.3 in Cloudflare’s range. No historical blocklist data exists, highlighting its novel deployment. The .pages.dev namespace frequently hosts disposable phishing infrastructure due to minimal verification requirements from Cloudflare’s free tier. Google’s certificate issuance complicates detection for endpoint users relying solely on SSL validation. Immediate mitigation requires blocking IP 188.114.96.3 and domain legion-apple-valley-mn.pages.dev across networks, DNS, and browser filters. Report the domain to Apple’s phishing portal (reportphishing@apple.com) and Cloudflare abuse teams (abuse@cloudflare.com) with seed reference d144d7. Users should verify Apple Gift Card solicitations directly through authenticated Apple channels (apple.com/gift-cards) and enable multi-factor authentication on Apple IDs. Consider implementing enterprise DNS filtering with Threat Intelligence feeds for proactive blocking of similar .pages.dev phishing domains leveraging Cloudflare’s anonymization services.