lejarlive-app[.]pages[.]dev

Analysis of lejarlive-app.pages.dev shows that the domain is actively resolving to the IPv4 address 188.114.97.3. The address is part of Cloudflare’s edge network, as indicated by the authoritative nameservers june.ns.cloudflare.com and watson.ns.cloudflare.com and the registration of the domain through Cloudflare, Inc. The domain appears on a single security blocklist, specifically PhishDestroy, which classifies it as a phishing resource. VirusTotal scans have recorded nine positive detections out of ninety‑one submitted security vendors, reinforcing the suspicion that the site is being used for malicious credential‑stealing or related activities. The risk rating assigned by the reporting system is elevated, and the status flag marks the domain as active, meaning the infrastructure is presently reachable.

No additional intelligence such as SSL certificate details, HTTP response codes, page titles, or Safe Browsing verdicts is available in the supplied data, leaving those aspects unverified. Consequently, defenders cannot confirm whether the site presents a TLS‑encrypted front‑end or which specific brand or login page it may be impersonating. The lack of further public metadata does not diminish the observed indicators, however, because the combination of blocklist listing, multiple vendor detections, and use of a widely abused CDN service is a common pattern for phishing infrastructure. Given the concrete evidence, security teams should treat lejarlive‑app.pages.dev as a confirmed phishing host.

Recommended mitigations include adding the domain to DNS‑based blocklists, enforcing outbound filtering of HTTP/S traffic to the resolved IP, and monitoring for any internal DNS queries that resolve to 188.114.97.3. Incident response actions may also involve collecting forensic logs from any user agents that attempted to access the domain to identify potential credential compromise.