financelegendapp-login[.]com

The domain financelegendapp-login.com is currently active and has been classified as a high‑risk brand‑impersonation operation. Infrastructure analysis shows the domain resolves to the IPv6 address 2a06:98c1:3121::3, which is advertised by AS13335 Cloudflare, Inc., indicating use of Cloudflare’s edge network and HTTP/3 support. The authoritative nameservers are chance.ns.cloudflare.com and rachel.ns.cloudflare.com, confirming Cloudflare hosting. Registration data reveal the domain was created on 13 August 2025 through Dynadout LLC, suggesting a relatively recent registration. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 label, and the HTTP response returns status code 200, enabling normal web traffic. Reputation checks show a Scamadviser trust score of 1/100 and a Gridinsoft score of 0/100, while VirusTotal records indicate that 13 of 95 scanned vendors flagged the domain as malicious. The domain is listed on at least one security blocklist and has been blocked by PhishDestroy. An MX record points to mx.idusfsdfifs.xyz, a non‑standard mail host that could be used for phishing communications. The page title "Finance Legend App Official Site 2025 - Join & Trade Now" and the brand target tag "across" suggest the site is attempting to impersonate the Across brand, likely to lure victims into credential theft or financial fraud. What remains uncertain is the exact content served to visitors, as no direct page analysis is available. Defenders should block the domain at perimeter and DNS layers, monitor for related C2 communications originating from the Cloudflare‑hosted IP, and quarantine any email traffic routed through the listed MX host. Continuous re‑evaluation is advised, given the active status and the presence of multiple threat intelligence indicators.