lerger-us-logoz-live-access[.]pages[.]dev

On 29 July 2026, the domain lerger-us-logoz-live-access.pages.dev was observed resolving to the IP address 188.114.96.3. The IP belongs to Cloudflare’s global edge network, and the domain is delegated to the Cloudflare name servers nolan.ns.cloudflare.com and sunny.ns.cloudflare.com, indicating that the infrastructure is hosted behind Cloudflare’s reverse‑proxy service. VirusTotal has recorded detections from seven of ninety‑one scanners, a modest but non‑trivial rate that suggests at least some security products recognize malicious behavior associated with the domain. The domain appears on a single public blocklist and is explicitly listed as blocked by the PhishDestroy service, reinforcing the view that it is being used for phishing‑related activity.

The registrar information shows the domain was provisioned through Cloudflare, Inc., a common choice for threat actors seeking rapid deployment and built‑in anonymity. The threat classification is listed as generic phishing, and the risk level is elevated with an active status, indicating ongoing operation. No public evidence has been published regarding the page title, SSL certificate details, HTTP response codes, or any specific brand being impersonated, so the exact content and payload remain unverified. Consequently, defenders cannot rely on content‑based signatures and should focus on network‑level indicators such as the domain name, its Cloudflare‑hosted IP, and the associated blocklist entries.

Recommended mitigation steps include adding the domain to DNS and web‑filter blocklists, monitoring outbound connections to the IP 188.114.96.3, and applying the same blocklist rules used by PhishDestroy. Continuous re‑scanning on VirusTotal and similar platforms is advised to capture any changes in detection coverage. Until further forensic analysis of the hosted page is performed, the domain should be treated as a high‑confidence phishing indicator.