guide-lejarlive[.]pages[.]dev

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

This domain, guide-lejarlive.pages.dev, is actively flagged as a generic phishing infrastructure. The domain is hosted on Cloudflare’s network, using the authoritative nameservers eve.ns.cloudflare.com and olof.ns.cloudflare.com, which confirms that the registration was performed through Cloudflare, Inc. DNS resolution points to the IPv4 address 188.114.97.3, an address that is shared across multiple abused sites observed in recent phishing campaigns. The domain appears on a single external blocklist and has been added to the PhishDestroy sinkhole, indicating that at least one sinkhole operator has intercepted traffic destined for the site. VirusTotal reports that eight of ninety‑one scanning engines have raised detections, suggesting that a minority of security products have identified malicious characteristics, while the majority have not produced a positive verdict.

This mixed detection profile is typical for rapidly deployed phishing domains that rely on short‑lived hosting. Public intelligence does not yet disclose the page title, SSL certificate details, HTTP response codes, or any observed landing‑page content, leaving the exact visual lure and credential‑harvesting technique unknown. Consequently, defenders cannot map the domain to a specific brand impersonation or payload type beyond the generic phishing classification provided. Given the available evidence, security teams should block the domain at network perimeters and add the IP address 188.114.97.3 to host‑based deny lists.

Email filters should be updated to reject any messages containing URLs that resolve to this domain or its associated IP. Continuous monitoring of threat‑intel feeds for additional sightings, changes in detection counts, or newly observed SSL fingerprints is advised. Organizations using DNS filtering should ensure the domain is present in their deny lists, and incident‑response teams should be prepared to investigate any credential submissions that reference this URL.