liga123login[.]com

Analysis of liga123login.com shows a newly registered domain created on May 21, 2026 and currently resolving to the IPv4 address 188.114.97.3. The domain is registered through Dynadot Inc and utilizes Cloudflare's DNS infrastructure, with authoritative nameservers carl.ns.cloudflare.com and pam.ns.cloudflare.com. It appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, indicating that at least one defensive feed has identified it as malicious.

VirusTotal records indicate that the domain was scanned by 91 antivirus and URL‑reputation engines; none of the scanners raised a detection at the time of the scan, but the absence of detections does not constitute confirmation of safety, especially given the blocklist entry and the domain's recent creation date. No publicly available SSL certificate details, HTTP response codes, or page title information have been disclosed, leaving those surface‑level indicators unverified. The combination of a recent registration, association with a known phishing blocklist, and the credential‑phishing classification suggests that the domain is likely being used to harvest user credentials, possibly targeting services that employ similar naming conventions.

Defenders should consider adding the domain to network‑level deny lists, monitoring DNS queries for lookups to 188.114.97.3, and employing URL filtering to block HTTP requests to the host. Continuous re‑scanning of the domain through multi‑engine services is recommended to capture any future changes in payload or hosting behavior.