legionbetgb-co-uk-dqg[.]pages[.]dev

The domain legionbetgb-co-uk-dqg.pages.dev is currently flagged as an active phishing endpoint specifically targeting authentication credentials under the guise of Cloudflare Access. Analysis indicates this infrastructure is designed to harvest login details through a fraudulent sign-in interface, as evidenced by the page title 'Sign in ・ Cloudflare Access.' This domain does not represent legitimate Cloudflare services and operates as a high-risk credential theft vector. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on May 18, 2026, with a creation date that suggests recent deployment for malicious purposes. It resolves to the IP address 188.114.97.3 and employs a Let's Encrypt SSL certificate (serial number E8) to present a false sense of security. Detection metrics show the domain is flagged by 2 of 95 security vendors on VirusTotal, while appearing on three distinct security blocklists. The low detection count relative to the number of engines suggests either evasion techniques or early-stage campaign deployment. Current status confirms the domain remains operational and unmitigated. Organizations and individuals are advised to implement immediate network-level blocking of 188.114.97.3 and the full domain legionbetgb-co-uk-dqg.pages.dev. Security teams should prioritize reviewing authentication logs for interactions with this endpoint, particularly those involving Cloudflare Access workflows. End users should be alerted to verify domain legitimacy before entering credentials, especially when prompted by unsolicited sign-in requests. Monitoring for additional domains registered through the same Cloudflare Pages infrastructure is recommended to identify potential campaign expansion.