feq-leger-com-start[.]pages[.]dev

PhishDestroy identifies feq-leger-com-start.pages.dev as a credential theft page impersonating a legitimate brand through a Cloudflare Pages deployment. The domain leverages Google Trust Services SSL certificates and Cloudflare infrastructure to enhance credibility. No known drainer kit or advanced obfuscation was detected during initial analysis, suggesting a basic but effective credential harvesting campaign targeting unsuspecting users. The threat actor likely relies on domain similarity and HTTPS trust indicators to deceive visitors into entering sensitive login credentials.

This domain resolves to IP address 172.66.44.98 and currently shows 6 out of 95 detections on VirusTotal, indicating it remains undetected by most antivirus engines. It is registered through Cloudflare, Inc., and secured with a Google Trust Services SSL certificate, both of which contribute to its perceived legitimacy. The domain was created recently and is hosted on Cloudflare Pages, a platform often abused for phishing due to its free tier and rapid deployment capabilities. No confirmed inclusion on Google Safe Browsing (GSB) or other major blocklists has been observed at this time.

The domain is currently active and under investigation by PhishDestroy’s anti-phishing team. Users are advised to block feq-leger-com-start.pages.dev at the network and endpoint levels. While the immediate risk is classified as under investigation, the absence of detections and use of reputable infrastructure heightens the potential for successful exploitation. Organizations should update firewall rules, email filters, and browser blocklists to prevent access. Remaining risk is moderate due to low detection rates and high infrastructure trust, requiring continued monitoring and user education to mitigate credential theft exposure.