gsbauwu1hsa[.]legalaro[.]com

The domain gsbauwu1hsa.legalaro.com was registered on May 27, 2026 through Realtime Register B.V. It resolves to IP 172.67.131.110, which belongs to Cloudflare's network, and uses Cloudflare's authoritative nameservers garret.ns.cloudflare.com and grannbo.ns.cloudflare.com. The domain appears on a single security blocklist and has been added to the PhishDestroy blocklist, indicating that at least one anti‑phishing feed has identified it as malicious. VirusTotal has scanned the domain and 13 of 91 security vendors flagged it, providing independent confirmation of suspicious behavior.

No additional public intelligence such as Safe Browsing, Open Threat Exchange, or SSL certificate details is currently available. The lack of a publicly disclosed page title or content analysis means the exact phishing payload cannot be confirmed, and the targeted brand or credential‑stealing technique remains unknown. However, the combination of recent registration, Cloudflare hosting, blocklist inclusion, and multiple vendor detections suggests the domain is actively being used for phishing.

Defenders should block the domain at the network perimeter, add it to internal URL filtering lists, and monitor DNS queries for the associated IP and nameservers. Further investigation, such as retrieving the landing page and extracting any credential‑capture forms, is recommended to fully characterize the campaign and to update detection signatures.