com-leger-desktop[.]pages[.]dev

This domain, com-leger-desktop.pages.dev, was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.47.175, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 name, indicating a valid HTTPS endpoint, but the HTTP response returned a 403 status code, suggesting the content is currently inaccessible. The page title returned from the server is “Suspected phishing site | Cloudflare”, and the service is classified as a credential phishing operation. Automated analysis on VirusTotal recorded nine detections out of ninety‑three scanners, confirming that multiple security vendors have flagged the domain as malicious.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. Infrastructure fingerprinting shows the use of Cloudflare‑provided security features, including HTTP/3 support and HTTP Strict Transport Security. A Gridinsoft trust score of 0 / 100 further reinforces the malicious assessment. At the time of reporting (25 July 2026) the site is taken offline, which may be the result of takedown actions or temporary suspension.

Current intelligence does not reveal the specific brand or service being impersonated beyond the generic credential‑phishing label, and no additional content analysis is available. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP range, and update internal threat‑intel feeds with the observed indicators, including the certificate issuer, IP address, and the nine VirusTotal detections. Ongoing observation is recommended to detect any re‑hosting attempts that could revive the phishing infrastructure.