yrrhh[.]pages[.]dev

Analysis of yrrhh.pages.dev indicates active credential phishing infrastructure. The domain, created on April 30, 2026, is registered through Cloudflare, Inc. and resolves to IP address 172.66.47.18, which belongs to Cloudflare infrastructure located in Canada. Authoritative nameservers are holly.ns.cloudflare.com and vicky.ns.cloudflare.com. The site serves HTTP status 200 over TLS with a certificate issued by Google Trust Services under the WE1 identifier, and enforces HSTS. Detected front‑end components include jsDelivr, cdnjs, crypto-js, and HTTP/3, all delivered via Cloudflare CDN. The page title returned by the server is "Guildhall," but no further content analysis is available. Reputation scoring shows a Gridinsoft trust score of 0 out of 100, and the domain is listed on two blocklists (PhishDestroy and ScamSniffer). VirusTotal records show scans by 91 vendors with no current flags, though the absence of detections does not imply safety. The threat is classified as generic credential phishing and remains under investigation. Defensive operators should consider blocking the domain and its associated IP, monitor for related activity, and incorporate the observed indicators—domain name, IP address, TLS certificate details, and listed blocklists—into detection rules. Continuous re‑evaluation is advised as additional intelligence becomes available.