l-liga[.]com

Analysis of l-liga.com indicates that the domain is being used for a confirmed generic phishing operation. The site was registered on September 12, 2025 through NAMECHEAP INC and is hosted on Cloudflare’s network (ASN13335). DNS resolution points to IP address 104.21.78.247, which is located in the United States and is part of Cloudflare’s edge infrastructure. The domain’s SSL certificate is issued by Google Trust Services under the WE1 identifier, demonstrating that TLS termination is being handled by a legitimate certificate authority, a common tactic to increase perceived trustworthiness. Nameserver records list corey.ns.cloudflare.com and dawn.ns.cloudflare.com, confirming Cloudflare as the DNS provider.

VirusTotal scans show that three of ninety‑one security vendors flagged the domain, indicating that at least a minority of detection engines have identified malicious characteristics. The domain also appears on a single security blocklist and has been explicitly blocked by the PhishDestroy threat‑intelligence feed, reinforcing the assessment of malicious intent. An HTTP request to the site returns a 404 status code, and the current operational status is marked as offline, suggesting that the phishing infrastructure may have been taken down or is temporarily inactive.

While the exact phishing lure, targeted brand, or credential‑capture page has not been publicly disclosed, the convergence of registration timing, Cloudflare hosting, a valid TLS certificate, vendor detections, and blocklist listings provides sufficient evidence for security teams to treat l-liga.com as a malicious domain. Defenders should continue to block the domain at network perimeters, update DNS sinkhole lists, and monitor any outbound connections to the associated IP address.