legendsdrop[.]shop

Analysis of the domain legendsdrop.shop indicates it was actively hosting a phishing page targeting Mobile Legends players. The domain, registered on March 4, 2026, through GoDaddy.com, LLC, resolved to the IP address 178.72.138.188, located in Russia under AS49505 (JSC Selectel). Nameservers ns19.domaincontrol.com and ns20.domaincontrol.com were in use, consistent with GoDaddy-managed infrastructure. The SSL certificate was issued by Let's Encrypt (serial E7), a common choice for both legitimate and malicious sites. The page title, 'MirageLegends — Магазин доната Mobile Legends,' explicitly references Mobile Legends, a mobile multiplayer online battle arena game, suggesting the site was designed to deceive users into entering payment or account credentials under the guise of in-game purchases or donations.

As of July 23, 2026, the domain is offline, though its prior operational status was confirmed by the presence of this title and detection by PhishDestroy. Nine of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. Technologies detected on the site include Node.js, React, Nginx, Next.js, and Webpack, which are not inherently malicious but are frequently used in phishing kits for their ease of deployment and dynamic content generation. Gridinsoft assigned a trust score of 0/100, reinforcing the domain's high-risk classification. No additional details about the phishing kit, payload delivery, or specific user interactions are available, as the site content was not preserved for deeper analysis.

Defenders should treat this domain as confirmed malicious and include it in blocklists. Given the Russian hosting and the use of Let's Encrypt, similar domains may reappear with slight variations in naming or infrastructure.