en-us-live-legre[.]pages[.]dev

PhishDestroy identifies en-us-live-legre.pages.dev as a recently activated domain involved in a generic phishing campaign, currently under investigation for mimicking legitimate service pages. This domain, hosted on Cloudflare Pages, leverages deceptive subdomain naming (en-us-live-legre) to masquerade as localized or official-looking content, a common tactic in credential harvesting operations. While the specific brand being impersonated remains unverified in current feeds, the structure suggests potential targeting of tech or financial service users, consistent with drainer kit deployments observed in similar campaigns.

Technical analysis of en-us-live-legre.pages.dev reveals critical indicators: the domain shows zero detections across 95 VirusTotal engines, maintains a valid SSL certificate issued by Google Trust Services, and resolves to IP 188.114.97.3. Registered through Cloudflare, Inc., the domain’s age and reputation metrics are currently neutral, with no presence on major blocklists at the time of analysis. This combination of low detection rates, recent infrastructure, and clean reputation highlights the stealthy nature of the threat, emphasizing the need for proactive monitoring of emerging domains.

The domain remains active with an 'under_investigation' status, indicating ongoing analysis by threat intelligence teams. Organizations are advised to block traffic to 188.114.97.3 and flag en-us-live-legre.pages.dev at network perimeters. While the immediate risk is categorized as investigatory due to low detection rates, the lack of historical data and SSL validation by a trusted CA suggests potential for escalation. Users should exercise caution when encountering pages hosted on this domain, verify URLs out-of-band, and report any interactions to security teams. Remaining risk hinges on the domain’s pivot toward recognizable brands or the activation of additional infrastructure.