en-us-lives-legr[.]pages[.]dev

PhishDestroy identifies en-us-lives-legr.pages.dev as a generic phishing site currently under investigation that masquerades as a legitimate live-service portal to harvest user credentials under the guise of an ‘en-us-lives’ experience. Threat intelligence shows the domain leverages a Cloudflare Pages template to deliver a lightweight but convincing decoy. No drainer kit signatures have been extracted from payload files at this time; the attack surface appears limited to credential phishing via a spoofed login interface.

This domain was flagged with a 6/95 detection score on VirusTotal as of the last scan, indicating zero security vendors currently recognize the threat. The registrar is Cloudflare, Inc., the resolved IP address is 188.114.97.3, and the site operates under a Google Trust Services SSL certificate. Creation date and exact blocklist counts remain unverified due to the domain’s recent registration tied to Cloudflare’s ephemeral Pages ecosystem; thus, the threat is classified as active with risk status under_investigation.

Current status places en-us-lives-legr.pages.dev in the investigative phase; no active takedown has been initiated, and the site remains accessible. Security teams are advised to monitor 188.114.97.3 for lateral movement and to block the domain at network and endpoint levels. Remaining risk is evaluated as elevated due to the potential for credential harvesting, although the short operational lifespan and low detection rate may limit exposure. Users are urged to avoid interacting with this page and to report any observed login prompts to their security operations center.