legder[.]lliive-apps[.]io

Analysis as of July 28, 2026 indicates that the domain legder.lliive-apps.io was registered on the same day and resolves to the IP address 188.114.97.3. The domain is hosted on Cloudflare infrastructure, as evidenced by the authoritative nameservers dan.ns.cloudflare.com and dawn.ns.cloudflare.com. The registrar listed for the registration is TLD Registrar Solutions Ltd. VirusTotal records show that the domain has been submitted to 91 scanning engines, none of which have returned a detection at the time of analysis; the absence of detections does not constitute a safety assurance.

The domain appears on a single external security blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service has identified it as malicious. No public information is available regarding SSL certificate details, HTTP response codes, page title, or any associated malware kits. Consequently, the precise content and phishing lure employed by the site remain unknown.

The combination of recent creation, dedicated Cloudflare nameservers, inclusion on a phishing blocklist, and active status suggests a purpose‑built phishing infrastructure. Defenders should proactively deny network traffic to 188.114.97.3, add legder.lliive-apps.io to URL filtering and email security policies, and continue to monitor VirusTotal and other threat‑intel feeds for any emerging detections. Ongoing observation of DNS changes and potential hosting shifts is recommended, as the short lifespan of the domain may be accompanied by rapid re‑deployment tactics.