24legion[.]biz

Analysis of 24legion.biz, observed on July 24, 2026, indicates that the domain is being used for a high‑risk generic phishing operation. The site returns HTTP 200 and presents the page title “Вы не робот?” which translates to “Are you not a robot?”. The SSL certificate is issued by Google Trust Services under the WE1 root, confirming that TLS is properly configured but does not guarantee legitimacy. Registration data show the domain was created on 06 April 2022 through NiceNIC International Group Co., Limited, and is served behind Cloudflare’s network (nameservers cody.ns.cloudflare.com and jamie.ns.cloudflare.com).

DNS resolution points to IP 91.206.71.47, an address located in the Netherlands and owned by AS13335 Cloudflare, Inc. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 / 100, Scamadviser rates the domain at 40 / 100, and the domain appears on one security blocklist. VirusTotal analysis reports that 1 of 95 scanning engines flags the domain, reinforcing the suspicion of malicious intent. The phishing‑specific blocklist PhishDestroy has already listed the domain as blocked. The available evidence confirms the presence of phishing‑related activity, but the exact payload, target brand, or credential‑harvesting mechanism has not been disclosed in the current intelligence.

Consequently, the precise phishing kit or victim profile remains uncertain. Defenders should block DNS resolution to 91.206.71.47, enforce URL filtering for 24legion.biz, and monitor outbound traffic for connections to Cloudflare‑hosted IPs that match the observed address. Continuous re‑scanning with multi‑engine services is advised to capture any new malicious files that may be served from the site. Users should be warned not to interact with the page, especially any prompts that resemble CAPTCHA challenges, as the title suggests a potential social‑engineering element.