en-app-lgrr[.]pages[.]dev

This domain is flagged as a generic phishing site specializing in credential harvesting, with an elevated risk assessment due to its active exploitation history. Analysis indicates the domain was designed to mimic legitimate login portals, tricking users into submitting sensitive authentication details such as usernames, passwords, and potentially multi-factor authentication codes. The elevated risk designation stems from its verified distribution in phishing campaigns and confirmed credential theft incidents prior to takedown. Infrastructure analysis reveals the domain en-app-lgrr.pages.dev was registered through Cloudflare Pages, a platform frequently abused for rapid phishing deployment. It resolves to the IP address 188.114.96.3, a Cloudflare-hosted endpoint commonly associated with malicious domains. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. The domain was created on March 28, 2026, though this future-dated registration suggests timestamp manipulation to evade detection. Detection metrics include 10/95 security vendors flagging the domain on VirusTotal, a Gridinsoft trust score of 0/100, and inclusion on one security blocklist. The page title 'Suspected phishing site | Cloudflare' confirms its malicious status, as Cloudflare automatically assigns this label to flagged domains. Mitigation against this credential harvesting threat requires immediate action from both end users and network administrators. Users who may have interacted with this domain should reset all credentials entered on the site, prioritizing accounts with financial or administrative access. Enable multi-factor authentication on all critical accounts to mitigate unauthorized access. Network administrators should block the domain en-app-lgrr.pages.dev and its resolving IP 188.114.96.3 at the firewall or DNS level to prevent internal access. Implement email filtering rules to quarantine messages containing this domain, as phishing campaigns often distribute such links via email. Monitor for unusual authentication attempts, particularly from the IP range associated with this domain. Given the domain's current offline status, organizations should remain vigilant for similar phishing domains using the same infrastructure patterns, such as Cloudflare Pages registrations with randomized subdomains.