app[.]liegion[.]cc

Analysis of app.liegion.cc shows that the domain was registered on 17 December 2025 through Web Commerce Communications Limited. The registration is recent and the domain is hosted behind Cloudflare, using the nameservers cortney.ns.cloudflare.com and ken.ns.cloudflare.com. DNS resolution points to 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 certificate profile, indicating that HTTPS connections would be trusted by browsers. Security telemetry indicates that app.liegion.cc appears on one public blocklist and is actively blocked by the PhishDestroy service.

VirusTotal scans have recorded detections from ten of ninety‑five antivirus or URL‑reputation engines, reinforcing the suspicion of malicious activity. The HTTP response returned a 403 status code, and the site is currently marked as offline, suggesting that the hosting provider may have taken the content down after reporting. The available evidence therefore points to a generic phishing operation, although the specific lure, targeted brand, or page title has not been disclosed publicly. No open‑source threat‑intel feeds such as OTX or Google Safe Browsing entries are referenced, and the content of the landing page has not been captured, leaving the exact social‑engineering technique unknown.

Because the domain utilizes Cloudflare’s reverse‑proxy services, its true origin infrastructure cannot be directly observed, which is a common tactic for phishing operators seeking to hide the backend server. Defenders should continue to block the domain at network perimeter devices, update DNS filtering policies to deny resolution of app.liegion.cc, and add the IP address 188.114.96.3 to any Cloudflare‑associated blocklists where appropriate. Monitoring for new resolutions or re‑registration of the domain is advised, as attackers often recreate phishing sites after takedown.