legal365[.]vip

legal365.vip was observed on 25 July 2026 hosting a page that returns HTTP 200 with the title “Just a moment…”. The site is protected by Cloudflare, uses Cloudflare Browser Insights and HTTP/3, and resolves to the Cloudflare‑owned address 188.114.96.3 (AS13335, United States). The TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid HTTPS connection. Registration data shows the domain was created on 21 February 2026 through NiceNIC International Group Co., Limited, and the authoritative nameservers are agustin.ns.cloudflare.com and romina.ns.cloudflare.com. VirusTotal has recorded five detections out of 91 scanned engines, and the domain appears on a single external blocklist.

It has also been flagged by the PhishDestroy feed, confirming active malicious use. The Gridinsoft trust score is 0 out of 100, reinforcing the low reputation. No additional public intelligence such as OTX or Safe Browsing entries is referenced in the current data set. The available evidence points to a newly registered, Cloudflare‑hosted infrastructure that is already being leveraged for generic phishing. The limited detection count suggests that the campaign may be in early stages or employing evasion techniques that avoid broader detection.

The lack of further context—such as the specific phishing lure, target brand, or payload—remains unknown, and no visual or content analysis has been published. Defenders should block or sinkhole the domain at the DNS level, enforce outbound filtering for connections to 188.114.96.3, and monitor for any HTTP requests containing the “Just a moment…” title. Email security gateways should be updated to reject messages referencing legal365.vip, and threat‑intel platforms should be instructed to enrich the indicator with any future sightings. Continuous re‑scanning with multi‑engine services is advised to capture potential changes in detection status.