legdrs-oi-es[.]pages[.]dev

This domain is flagged as an elevated-risk credential harvesting phishing site targeting user authentication data. Analysis indicates a deliberate attempt to mimic legitimate login portals, with infrastructure designed to evade initial detection while harvesting sensitive credentials. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 03, 2026, resolving to IP address 172.66.44.76 located in California. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to appear legitimate. Detection engines report 17/95 security vendors flagging this domain, with PhishDestroy blocking access. The domain appears on one security blocklist and is currently offline, though prior activity remains a concern. Mitigation requires immediate action from network administrators and end users. Block the domain and IP 172.66.44.76 at firewall level, revoke any cached SSL certificates associated with this site, and monitor for credential reuse attempts. Users should reset passwords if exposure is suspected, enable multi-factor authentication, and verify domain authenticity before entering credentials. Security teams should analyze logs for connections to this IP and domain to identify compromised accounts.