us-live-legr[.]pages[.]dev

PhishDestroy identifies us-live-legr.pages.dev as a domain actively involved in generic phishing operations. The current investigation status remains under active review as security teams gather additional intelligence. No specific brand impersonation has been confirmed at this stage, but the domain's infrastructure suggests opportunistic credential harvesting or malicious payload delivery.

This domain was flagged by 0 of 95 VirusTotal vendors at the time of analysis, indicating negligible detection coverage. It was registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3. The associated SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. Despite its low detection rate and clean SSL profile, the domain exhibits behavioral traits consistent with phishing infrastructure, including rapid registration and hosting on a shared cloud platform known for abuse.

Given the active status and lack of vendor detection, users are strongly advised to block access to us-live-legr.pages.dev at the network perimeter. Organizations should inspect DNS logs for queries to this domain and correlate against proxy/WAF logs for connection attempts. Implementing browser-based controls or endpoint policies to block access to pages.dev subdomains may further reduce exposure. Security teams are encouraged to monitor this domain for escalation in threat activity, as the absence of detections does not equate to safety.