legre-desktop-live[.]pages[.]dev

Analysis of legre-desktop-live.pages.dev shows an active generic phishing infrastructure with elevated risk. The domain was created on October 11, 2025 and is hosted via Cloudflare Pages, resolving to the IP address 172.66.44.236. It appears on a single public security blocklist and has been explicitly blocked by PhishDestroy.

VirusTotal reports that 12 out of 91 antivirus and URL‑reputation engines flag the domain as malicious, indicating moderate consensus among scanners. The limited blocklist presence suggests the domain is relatively new in the threat ecosystem, but the detection count demonstrates that multiple vendors have identified malicious behavior. No additional intelligence such as Safe Browsing alerts, OTX references, SSL certificate details, HTTP status codes, or page‑title metadata is available at this time, leaving the full scope of the phishing campaign uncertain.

Defenders should immediately block the domain at DNS and proxy layers, monitor outbound connections to the associated IP 172.66.44.236, and include the domain in endpoint allow‑list exclusions to prevent credential harvesting. Continuous re‑scanning with VirusTotal and other URL reputation services is recommended to capture any changes in detection status. Organizations that rely on Cloudflare Pages for legitimate content should consider reviewing any sub‑domain usage policies to mitigate abuse of the platform for similar phishing deployments.