leger-com-strt-us[.]pages[.]dev

Analysis of the domain leger-com-strt-us.pages.dev indicates it is actively involved in phishing operations targeting users with fraudulent account verification prompts. Registered through Cloudflare, Inc., the domain resolves to the IP address 172.66.47.152, which is associated with Cloudflare's infrastructure. The nameservers ethan.ns.cloudflare.com and sunny.ns.cloudflare.com further confirm its hosting on Cloudflare's platform. As of July 29, 2026, the domain appears on one security blocklist and is flagged by 6 out of 91 security vendors on VirusTotal, suggesting detection by multiple independent engines.

The domain's structure, incorporating 'leger' and 'strt-us,' implies an attempt to impersonate Leger, though no direct evidence from page content or brand targeting data confirms this specific association. The use of Cloudflare Pages (.pages.dev) is notable, as this service is frequently exploited for phishing due to its free hosting and automatic SSL provisioning, which lends a superficial appearance of legitimacy. Defenders should treat this domain as high-risk infrastructure, particularly for credential harvesting or account takeover attempts.

Network-level blocking at the domain and IP level is recommended, alongside monitoring for related subdomains or newly registered lookalike domains. The domain's registration details remain consistent with phishing campaigns observed in similar cases, though no specific phishing kit or payload has been identified in the available data. Further investigation into associated email addresses, SSL certificates, or historical DNS records may provide additional context, but current evidence supports immediate mitigation actions.