legayagov21[.]pro

The domain legayagov21.pro was registered on 13 March 2026 through REG.RU LLC, a Russian registrar that frequently appears in malicious infrastructure. The domain resolves to Cloudflare name servers marjory.ns.cloudflare.com and yadiel.ns.cloudflare.com, indicating the use of a reputable CDN service to obscure the true hosting location. VirusTotal has recorded eight detections out of ninety‑one scanned security vendors, demonstrating that a subset of anti‑malware products have identified the domain as malicious. The domain is listed on at least one public security blocklist and has been actively blocked by the PhishDestroy filtering service, confirming that threat‑intel feeds consider it a phishing‑related resource.

The current risk rating is elevated and the operational status is active, suggesting that the infrastructure is still being used to deliver malicious content or credential‑harvesting pages. Publicly available data does not include a page title, SSL certificate details, HTTP response codes, or any observed hosting IP address, leaving the precise content and geographic hosting unknown. Likewise, no Safe Browsing, OTX, or additional blocklist entries have been disclosed, so the broader detection footprint cannot be fully assessed.

Defenders should therefore treat any outbound traffic to legayagov21.pro as suspicious. Organizations are advised to add the domain to DNS and proxy blocklists, monitor network logs for connections to the associated Cloudflare name servers, and enforce multi‑factor authentication for accounts that could be targeted by credential‑stealing campaigns. Continuous threat‑intel monitoring is recommended to capture any future enrichment, such as observed payloads, IP addresses, or victim reports that could refine detection rules.