home-eng-legr-live-download[.]pages[.]dev

Analysis of the domain home-eng-legr-live-download.pages.dev, observed on 29 July 2026, classifies it as a generic phishing infrastructure with an elevated risk rating. The domain is hosted on Cloudflare’s network, as indicated by its registration through Cloudflare, Inc., and by the authoritative nameservers justin.ns.cloudflare.com and kristina.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which is a Cloudflare‑owned address commonly used for CDN and proxy services. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy filtering service.

VirusTotal has processed the domain and 9 of 91 scanned security vendors have returned a malicious verdict, reinforcing the phishing classification. No additional contextual data such as SSL certificate details, HTTP response codes, Safe Browsing status, OTX mentions, or page‑title information were available at the time of analysis. Uncertainty remains regarding the specific payload or credential‑harvesting technique employed, as the landing page has not been publicly examined and no page‑title or content hash is provided.

Defenders should therefore treat any traffic to this domain as malicious. Recommended actions include adding the domain to local deny lists, enforcing DNS‑level blocking, updating network intrusion detection signatures to flag connections to 188.114.96.3 when associated with this FQDN, and monitoring for any future appearance on additional blocklists or security feeds. Continuous re‑evaluation is advised should new intelligence, such as SSL fingerprint or HTTP status, become available.