en-us-desktop-legr[.]pages[.]dev

Analysis of en-us-desktop-legr.pages.dev as of 29 July 2026 indicates that the domain is actively used for a generic phishing campaign. The domain resolves to the IPv4 address 172.66.44.151 and is served through Cloudflare’s infrastructure, as evidenced by the authoritative nameservers nico.ns.cloudflare.com and vita.ns.cloudflare.com and the registrar record indicating registration via Cloudflare, Inc. VirusTotal has processed the domain with 91 antivirus and URL‑reputation vendors; none of the scanners currently flag the domain, but the lack of detections does not constitute a safety assurance.

The domain is listed on one external security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that threat‑intel feeds consider it malicious. No additional data such as Safe Browsing verdicts, Open Threat Exchange reports, SSL certificate details, HTTP response codes, or page‑title information are available in the current intelligence set, leaving the surface‑web characteristics of the site unverified.

Defenders should therefore treat the domain as hostile: block network traffic to 172.66.44.151, add the fully‑qualified domain name to URL filtering policies, and monitor for any authentication attempts that may be directed to this host. Continuous re‑assessment is advised, as future scans by additional vendors or updates to blocklists may change the detection posture.