mail[.]cga[.]legionweb[.]co

The domain mail.cga.legionweb.co has been identified as a generic phishing threat, specifically targeting users of Roundcube Webmail, a popular open-source webmail interface. The page title observed was 'Roundcube Webmail :: Welcome to Roundcube Webmail', indicating an attempt to mimic legitimate login portals to steal credentials. No specific brand or drainer kit was identified, but the domain's structure suggests a credential harvesting campaign aimed at email account access.

Technical indicators paint a clear risk profile. VirusTotal shows 4 out of 95 security vendors flagging this domain as malicious, confirming community-wide concern. The domain resolves to IP address 199.16.129.199 and was registered through PlanetHoster Inc. on February 21, 2026, which is a future date relative to typical analysis, suggesting either a data anomaly or a domain created with malicious intent. It appears on 3 security blocklists and uses a Let's Encrypt SSL certificate (E7), which provides encryption but does not validate legitimacy. Google Safe Browsing status is not explicitly provided but the blocklist presence indicates active monitoring.

Currently, the domain has been taken offline, mitigating immediate risk. However, the underlying infrastructure may still pose a threat if reactivated. Users who may have visited the site or entered credentials should change passwords immediately and enable multi-factor authentication. PhishDestroy recommends ongoing monitoring of related domains and IPs, as similar phishing campaigns often re-emerge under new domains. Remaining risk is moderate due to the domain's offline status, but vigilance is advised given the low detection rate and future creation date.