originslgns[.]live

Analysis of originslgns.live shows a high‑risk, active phishing infrastructure. The domain was registered on February 22, 2026 through Web Commerce Communications Limited and resolves to 188.114.96.3, an IP owned by Cloudflare (AS13335) located in the United States. DNS is served by gordon.ns.cloudflare.com and liz.ns.cloudflare.com, and the site advertises Cloudflare and HTTP/3 as underlying technologies. TLS termination is provided by a Google Trust Services / WE1 certificate, indicating a valid SSL chain despite the malicious intent.

HTTP responses include a 301 redirect and, when accessed, a page title of "originslgns.live | 522: Connection timed out," reflecting a Cloudflare 522 error page rather than the actual phishing payload. This suggests the site may be intermittently offline or deliberately returning an error to evade analysis. Detection signals are strong: five of ninety‑five VirusTotal scanners flag the domain, it appears on three external blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. The combination of recent registration, legitimate‑looking TLS, and Cloudflare hosting is a common pattern for fast‑flux or disposable phishing sites.

Uncertainty remains around the exact content and victim‑targeting because the site does not currently serve a visible page. Defenders should immediately block the domain and its resolving IP at network perimeters, add the domain to internal threat‑intel feeds, and monitor for any new subdomains or similar registrations using the same registrar or Cloudflare nameservers. Continuous re‑resolution checks are advised, as Cloudflare can dynamically reassign IPs. Given the high risk rating and active blocklist status, the domain should be treated as malicious until a thorough content grab confirms otherwise.