en-us-livelegre[.]pages[.]dev

PhishDestroy identifies en-us-livelegre.pages.dev as an active phishing site currently impersonating a trusted brand to deceive users into divulging sensitive credentials or payment details. The domain leverages Cloudflare Pages for hosting and employs HTTPS via Google Trust Services to appear legitimate. Current threat status is elevated, with malicious activity ongoing and no signs of takedown as of the latest intelligence update.

This domain was flagged by 1 of 95 VirusTotal security vendors and is registered through Cloudflare, Inc. It resolves to IP address 188.114.97.3 and utilizes a Google Trust Services SSL certificate to enhance its deceptive credibility. The domain’s infrastructure is hosted on Cloudflare’s Pages platform, which is frequently exploited by threat actors to rapidly deploy phishing campaigns with minimal detection. With a single VirusTotal detection and no additional blocklist entries recorded, this site presents a high evasion risk and requires immediate attention.

As of this assessment, en-us-livelegre.pages.dev remains active and poses a credible threat to unwary users. PhishDestroy recommends blocking access to this domain at the network perimeter via DNS sinkholing or firewall rules targeting IP 188.114.97.3 and the domain itself. Users who have recently interacted with this domain should treat any entered credentials as compromised and initiate password resets across affected accounts. Organizations are advised to update threat intelligence feeds and SIEM rules to include this IOC (Indicator of Compromise) and conduct user awareness training to mitigate risks associated with cloud-hosted phishing campaigns. Continuous monitoring of this domain is strongly recommended due to its high evasion potential and active status.