en-us-liive-ledgr[.]pages[.]dev

PhishDestroy identifies en-us-liive-ledgr.pages.dev as an active Amazon Gift Card scam operation, currently under investigation for phishing-related fraud. This domain mimics legitimate Amazon services to deceive users into surrendering payment credentials under the guise of gift card redemption offers. Given its current status, immediate defensive actions are advised to mitigate potential credential harvesting risks.

This domain was flagged with zero detections across 95 VirusTotal engines, indicating a stealthy and recently deployed threat. It resolves to IP 188.114.96.3 and operates under Cloudflare, Inc.'s infrastructure, leveraging Google Trust Services' SSL certificate to appear legitimate. No historical data suggests prior abuse, though the pages.dev subdomain structure raises concerns about rapid deployment cycles common in credential harvesting campaigns. Cloudflare's anonymizing proxy obscures the true hosting origin, complicating attribution.

To counter this threat, SOC teams should implement domain blocking for en-us-liive-ledgr.pages.dev and 188.114.96.3 at the DNS/network level. Users must be warned against interacting with Amazon-themed gift card solicitations via email or unsolicited links. If access occurs, enforce password resets for any accounts exposed to credential entry. Preserve browser artifacts for forensic analysis, as the domain's low detection profile suggests potential evolution in tactics. Report this domain to Cloudflare Abuse for takedown via their abuse portal.