allegrolokalnie[.]793r727482824472424[.]cfd

This domain, allegrolokalnie.793r727482824472424.cfd, is identified as a credential harvesting phishing infrastructure. Analysis indicates it was actively used to impersonate legitimate services, likely targeting users through fraudulent login portals designed to capture account credentials. The domain is currently offline, but prior activity suggests it posed a high risk to individuals and organizations. Infrastructure analysis reveals the domain was created on February 21, 2026, and registered through Global Domain Group LLC. It resolved to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. Security vendors flagged the domain as malicious, with 20 of 95 VirusTotal engines detecting it as phishing-related. Google Safe Browsing also classified it as phishing, and it appeared on at least one security blocklist. Notably, the domain lacked an SSL certificate, increasing the likelihood of detection by network monitoring tools. The domain is currently offline, but its prior infrastructure and detection history warrant continued monitoring. Organizations are advised to block the domain and associated IP address (188.114.97.3) at the network level. Security teams should review logs for connections to this domain or IP, particularly from February 2026 onward, and educate users on recognizing phishing attempts targeting credential submission portals.