info-legrr-en-live[.]pages[.]dev

This domain is flagged as a credential harvesting phishing site, a specific threat type targeting user authentication data through deceptive login interfaces. The risk level is classified as elevated due to confirmed malicious activity and infrastructure analysis revealing high-confidence indicators of compromise. Immediate action is warranted to prevent potential account takeovers or unauthorized data access. Analysis indicates the domain info-legrr-en-live.pages.dev was registered on April 02, 2026, through Cloudflare, Inc., an unusually future-dated creation that may suggest domain spoofing or abuse of registration systems. It resolves to the IP address 188.114.97.3 and holds an SSL certificate issued by Google Trust Services, which alone does not guarantee legitimacy. Security vendors on VirusTotal flagged the domain at a 10/95 detection rate, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was actively blocked by PhishDestroy prior to being taken offline. Infrastructure analysis reveals the page title was explicitly labeled 'Suspected phishing site | Cloudflare,' further corroborating malicious intent. Mitigation steps for this credential harvesting threat include immediate blacklisting of the domain and IP across all network security controls. Organizations should conduct retrospective log analysis for any user interactions with the domain, particularly authentication attempts or form submissions. Endpoint protection systems should be updated to detect and block future variants of this phishing campaign, while security teams verify multi-factor authentication enforcement for all critical accounts. User awareness training should emphasize the risks of entering credentials on untrusted sites, even those hosted on seemingly legitimate platforms.