legder[.]lilve-us[.]com

Analysis of legder.lilve-us.com indicates that the domain was registered on July 22, 2026 through MAT BAO CORPORATION and is currently resolving to the Cloudflare‑hosted address 188.114.97.3. The authoritative name servers are dan.ns.cloudflare.com and dawn.ns.cloudflare.com, confirming the use of Cloudflare DNS infrastructure. A VirusTotal scan performed by 91 antivirus and URL‑reputation engines returned no detections, but the absence of a malicious flag does not constitute evidence of benign intent.

The domain appears on a single external security blocklist and is actively blocked by the PhishDestroy service, which classifies it as a phishing resource. No additional public reputation services, such as Google Safe Browsing or Open Threat Exchange, have reported the domain, and there are no available SSL certificate details, HTTP response codes, or page‑title metadata to further characterize the hosted content. The limited evidence set therefore constrains confidence in the threat attribution to the generic phishing category, yet the presence on a dedicated phishing blocklist and the rapid creation date suggest a purposeful abuse of the domain for credential‑harvesting campaigns.

Defenders should continue to block traffic to 188.114.97.3 and to legder.lilve-us.com at the network perimeter, monitor for any anomalous authentication attempts targeting credential stores, and consider adding the domain to internal threat‑intel feeds. Ongoing observation of DNS resolution patterns and any future reputation updates is recommended to refine risk posture.