eligble-layer3foundation[.]pages[.]dev

Eligble-layer3foundation.pages.dev presents a significant phishing threat by imitating the Layer3 App. The domain is flagged as malicious by 13 out of 91 vendors on VirusTotal, indicating a high level of suspicion among security services. Currently, the domain is active and listed on three public blocklists, including PhishDestroy, ScamSniffer, and Enkrypt. The domain is registered with Cloudflare, Inc., and hosted on an IP address located in the United States.

The domain's SSL certificate is issued by Google Trust Services, which might lend it an appearance of legitimacy to unsuspecting users. However, the platform risk score of 100 out of 100 highlights the severe threat it poses. This score suggests that the domain is highly likely to engage in malicious activities, particularly phishing.

Despite being first detected by PhishDestroy in June 2026, the domain was created in July 2024, indicating a possible long-term strategy by the threat actors. The use of Cloudflare's infrastructure may also suggest an attempt to leverage reputable services to mask malicious intent. The domain's mimicry of the Layer3 App could potentially trick users into divulging sensitive information, such as login credentials or financial data. Given these factors, eligble-layer3foundation.pages.dev represents a critical threat that requires immediate attention.