app-legion[.]cc

This domain, app-legion.cc, is identified as a high-risk brand impersonation threat targeting users of the Base blockchain platform. The site presents itself as a merit-based crypto fundraising platform under the title 'Legion | Merit-Based, Crypto Fundraising Platform,' a tactic designed to deceive users into disclosing sensitive credentials or transferring digital assets. No explicit drainer kit signatures have been confirmed, but the domain’s structure and branding align with known impersonation campaigns targeting decentralized finance (DeFi) ecosystems. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.192.120, hosted on Cloudflare’s network (AS13335). It was registered on October 8, 2025, through NameSilo, LLC, and employs an SSL certificate issued by Google Trust Services (WE1). Detection metrics indicate significant malicious activity, with 16 out of 95 security vendors on VirusTotal flagging the domain as phishing. Google Safe Browsing has also classified the site as a phishing threat. The domain appears on three independent security blocklists, further corroborating its malicious intent. As of the latest assessment, app-legion.cc has been taken offline, likely in response to reports from security entities such as PhishDestroy, MetaMask, and SEAL. However, residual risk persists due to the domain’s recent registration and the potential for infrastructure reuse. Users who interacted with the site are advised to revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to mitigate future exposure.