grandleagueinfo[.]online

grandleagueinfo.online is currently listed as an active generic phishing site with a high risk rating. The domain was registered on 14 May 2026 through Spaceship, Inc., and resolves to the IPv4 address 37.49.229.75, which is hosted in the Netherlands and associated with the ESTOXY OU network operator. HTTP requests return a 200 status code and the site presents a valid Let’s Encrypt certificate (R13). The visible page title “My Blog – My WordPress Blog” suggests the front‑end is a default WordPress installation, a common lure for credential‑stealing pages. The domain is served by the authoritative name servers ns1.globaldnsnetwork.com and ns2.globaldnsnetwork.com. Reputation metrics are poor: Gridinsoft assigns a trust score of 18 / 100, and VirusTotal records four positive detections out of ninety‑five scanned security vendors. The domain is already blocked by the PhishDestroy list and appears on a single external blocklist, as well as being referenced in one AlienVault OTX pulse. While the infrastructure points to a deliberately hosted phishing portal, the specific target audience or brand impersonated remains unclear from the available data. No malicious payload hashes, command‑and‑control endpoints, or exploit kits have been observed in the current intelligence set. The low trust score and multiple vendor flags indicate malicious intent, yet the lack of publicly disclosed phishing content limits the ability to attribute the campaign to a particular threat actor or campaign. Defenders should treat grandleagueinfo.online as a high‑confidence phishing indicator. Immediate actions include adding the domain to network and email block lists, monitoring DNS queries for the associated name servers, and employing sink‑hole or sandbox analysis on any retrieved page content. Continuous re‑evaluation is advised, as the site may evolve to host additional payloads or expand its targeting scope.