legr-strt-faq[.]pages[.]dev

PhishDestroy identifies legr-strt-faq.pages.dev as an active generic phishing domain leveraging a fraudulent FAQ page to impersonate legitimate services. The domain utilizes Cloudflare’s infrastructure, hosted on IP 188.114.97.3 under Google Trust Services SSL. No specific drainer kit or branded impersonation (e.g., PayPal, bank) is yet confirmed, but the generic phishing approach suggests opportunistic credential harvesting.

Technical indicators show 8/95 VirusTotal detections (seed 599160), registered via Cloudflare, Inc., with no disclosed creation date. The IP 188.114.97.3 is associated with Cloudflare’s proxy network, and the domain’s Google-branded SSL certificate adds superficial legitimacy. As of this analysis, the domain remains unblocked by Google Safe Browsing (GSB) and has zero blocklist entries, indicating an undetected threat.

Current status: Active. This domain is under investigation with a 'under_investigation' risk rating. No takedown or blocklisting has been applied despite the phishing threat. Users are advised to avoid interaction; security teams should monitor for domain mutations. Remaining risk is high due to the lack of detection and active infrastructure.