ldegres-lives[.]pages[.]dev

PhishDestroy identifies ldegres-lives.pages.dev as an active generic phishing domain impersonating a live event platform to harvest payment card details and credentials from unsuspecting visitors. The domain is likely part of a broader malvertising or SEO poisoning campaign designed to lure users searching for streaming events or exclusive content. No specific drainer kit or branded spoof has been confirmed, but the page structure suggests a generic JavaScript-based credential and payment skimmer commonly used in these campaigns.

This domain was flagged with a current VirusTotal detection score of 6 out of 95 engines, indicating it remains undetected by most antivirus and security tools. It is registered through Cloudflare, Inc., resolves to IP 188.114.97.3, and operates under a Google Trust Services SSL certificate, which may help it bypass traditional browser security warnings. The domain shows no presence on the Google Safe Browsing (GSB) blocklist as of the latest scan, and no third-party blocklist entries have been recorded. No creation date was provided in the intelligence, but the page.dev subdomain and Cloudflare usage suggest recent deployment targeting trending or event-related searches.

As of the latest intelligence, the status of ldegres-lives.pages.dev remains active and under investigation. Users are advised to avoid interacting with this domain and block the associated IP 188.114.97.3 at the network perimeter. Organizations should monitor for outbound connections to this IP and scan endpoints for signs of credential or payment data exfiltration. While the immediate risk is elevated due to lack of detection, the absence from blocklists and low VT score indicate this campaign is still early in its lifecycle. Remaining risk includes continued spread through malvertising or compromised ads, with potential for increased detection as security vendors update signatures. Immediate blocking and user awareness remain the most effective mitigations.