legar-live-dwld[.]pages[.]dev

On 29 July 2026 the domain legar-live-dwld.pages.dev was observed in active generic phishing campaigns. The domain is hosted on Cloudflare’s network, using the nameservers kinsley.ns.cloudflare.com and kurt.ns.cloudflare.com, and resolves to the IP address 188.114.96.3. Registration information indicates the domain was provisioned through Cloudflare, Inc., confirming the use of a reputable DNS provider to obscure the true operator. VirusTotal analysis shows that five of ninety‑one scanning engines have flagged the domain as malicious, providing modest but notable detection consensus.

The domain is currently listed on one public security blocklist and is actively blocked by the PhishDestroy service, demonstrating that at least one dedicated anti‑phishing platform has incorporated it into its protection feed. No public page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts are available in the current intelligence set, leaving the exact content and credential‑capture mechanisms unverified. Likewise, Open Threat Exchange references are absent, and no additional threat‑intel sources have published indicators of compromise beyond the blocklist entry.

Consequently, the precise target brand or lure employed by the site cannot be confirmed at this time. Defenders should add the IP address 188.114.96.3 and the full domain name to DNS and proxy block policies, monitor for any outbound connections to the listed nameservers, and ensure that endpoint protection solutions ingest the VirusTotal detection count. Continuous re‑evaluation of the domain’s status is recommended, as further analysis may reveal additional malicious attributes such as malicious payloads or credential‑harvesting forms.