legionccs[.]com

legionccs.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and uses Cloudflare nameservers pat.ns.cloudflare.com and porter.ns.cloudflare.com. The domain resolves to IP address 104.21.94.102, which belongs to AS13335 Cloudflare, Inc., indicating the site is hosted behind Cloudflare's reverse‑proxy service. The presented SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV E36, confirming a valid TLS handshake but offering no guarantee of legitimacy. A page title retrieved from the live site reads “Loja”, a Portuguese term for “store”, yet no further content analysis is available.

Security‑vendor scans on VirusTotal recorded two positive detections out of ninety‑three scanners, and the domain appears on a single public blocklist. Gridinsoft assigned a trust score of zero out of one hundred, and the domain has been listed by the PhishDestroy blocklist, leading to its current offline status. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, consistent with the underlying CDN infrastructure. The combination of recent creation, low trust score, limited vendor detections, and blocklist listings suggests the domain was used for a phishing campaign, though the specific target or payload remains unknown.

Defenders should add legionccs.com to URL filtering and sink‑hole rules, monitor DNS queries for the associated IP range, and enforce TLS inspection to capture any malicious payloads if the site reappears. Continuous re‑scanning is recommended to capture any changes in vendor detection rates. Until further forensic evidence is obtained, the domain should be treated as malicious and blocked at network perimeters.