doc-leger-live-lo[.]pages[.]dev

PhishDestroy identifies that doc-leger-live-lo.pages.dev is actively hosting a counterfeit login interface designed to harvest credentials under the guise of a legitimate service. This domain, registered via Cloudflare, Inc., resolves to IP 188.114.96.3 and leverages a Google Trust Services SSL certificate to appear authentic. The infrastructure aligns with known patterns used by credential phishing campaigns targeting users seeking document or legal-related services.

This domain was flagged with a risk level of 'under_investigation' due to its active status and lack of detection on VirusTotal, which currently shows 14/95 security engines identifying the threat. Registered through Cloudflare’s Pages service, the domain employs Cloudflare’s infrastructure to evade traditional blocking mechanisms. While the SSL certificate issued by Google Trust Services adds superficial legitimacy, the absence of detections suggests either a newly deployed campaign or one fine-tuned to bypass initial scans. PhishDestroy’s seed 'cee37a' indicates this is a tracked variant of a broader phishing operation.

Users who visited doc-leger-live-lo.pages.dev should immediately check for unauthorized access to email or document accounts accessed via this page. Disable any saved sessions linked to the credentials entered and enable multi-factor authentication on all related accounts. Report the domain to PhishDestroy for further analysis. Avoid re-entering credentials on this or similar suspicious pages, as the campaign is designed to siphon authentication details for subsequent account takeover. Monitor financial and sensitive accounts for unusual activity linked to the time of interaction.