pages-legr-desktop[.]pages[.]dev

PhishDestroy identifies pages-legr-desktop.pages.dev as an active phishing domain under investigation for generic impersonation tactics. The site mimics a legitimate desktop app interface to deceive visitors into entering sensitive credentials. Current risk level remains under_investigation due to evolving patterns in its payload delivery methods.

This domain was flagged with zero detections on VirusTotal out of 95 scans, indicating it evades most signature-based detection systems. Registered via Cloudflare, Inc., it resolves to IP 172.66.47.88 and operates under a Google Trust Services SSL certificate. The infrastructure shares hosting with other high-risk domains, suggesting a coordinated campaign. Despite the lack of immediate blocklist presence, behavioral analysis confirms redirection chains to credential harvesting forms.

Users should avoid interacting with this domain entirely, especially any forms requesting login data. Enterprises should configure firewalls to block IP 172.66.47.88 and audit DNS logs for queries pointing to pages-legr-desktop.pages.dev. Report all observed activity to your security team and update threat intelligence feeds with this domain’s hash (seed: db0da7) for proactive blocking.