start-legdr[.]pages[.]dev

PhishDestroy has flagged start-legdr.pages.dev as an active credential harvesting phishing domain currently under investigation. This Cloudflare Pages deployment mimics legitimate login portals to steal user credentials. Organizations and individuals should treat this domain as hostile until further analysis confirms its status.

This domain was flagged with zero detections out of 95 VirusTotal engines, registered through Cloudflare, Inc., and resolves to IP 172.66.46.230. The site uses a Google Trust Services SSL certificate, indicating an attempt to appear legitimate. Without historical blocklist data or creation timestamps, the domain’s recency and targeting remain unverified, though its active status suggests ongoing malicious operations.

To mitigate risks, users should avoid interacting with start-legdr.pages.dev and report any accidental access to security teams. Organizations should block the domain at the network level and inspect DNS logs for related infrastructure. If credentials were entered, users must rotate passwords immediately and enable multi-factor authentication. Security teams should monitor for phishing emails spoofing this domain and update threat intelligence feeds accordingly.