legercom-start-auths[.]pages[.]dev

Analysis as of July 25 2026 indicates that the domain legercom-start-auths.pages.dev was registered on February 21 2026 through Cloudflare, Inc. The domain resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a Cloudflare‑generated page titled “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code. The TLS certificate is issued by Google Trust Services under the WE1 profile, confirming the use of a valid HTTPS endpoint. Passive scans show the presence of HSTS, HTTP/3, and Cloudflare‑specific headers, confirming that the infrastructure is fully hosted on Cloudflare’s edge network. Threat intelligence sources have classified the domain as a credential phishing operation.

PhishDestroy has already added the domain to its blocklist, and a separate blocklist also lists the domain, giving it a total of one external blocklist entry. VirusTotal reports that 14 of 93 security vendors have flagged the domain, indicating a moderate level of detection consensus. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The nameservers elijah.ns.cloudflare.com and bethany.ns.cloudflare.com are standard Cloudflare delegations and do not provide additional attribution. The current operational status is offline, with the site returning a 403 response, which suggests that the phishing content may have been taken down or is temporarily inaccessible.

No further page content has been captured, and the exact phishing lure or target brand has not been disclosed beyond the generic “credential phishing” label. Consequently, the precise tactics, techniques, and procedures employed by the actors remain unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of activity, and consider adding the associated IP address 188.114.96.3 to reputation lists.