legion[.]click

This domain, legion.click, is identified as a generic phishing site designed to harvest user credentials through deceptive login interfaces. Analysis indicates no direct association with a specific brand or known phishing kit, though its infrastructure aligns with common credential theft campaigns. The domain was registered recently and lacks legitimate historical use, reinforcing its classification as malicious. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 76.223.105.230, hosted on infrastructure belonging to AS16509 (Amazon.com, Inc.) in the United States. It was registered on April 15, 2025, through 1API GmbH and secured with an SSL certificate issued by GoDaddy.com, Inc. (Go Daddy Secure Certificate Authority - G2). The domain appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal, with detection labels including phishing and fraudulent activity. No Google Safe Browsing (GSB) listing was confirmed at the time of assessment. Current status indicates the domain has been taken offline, likely due to hosting provider intervention or registrar enforcement. Despite its inactive state, residual risk persists due to potential reuse of the domain or associated infrastructure in future campaigns. Organizations are advised to monitor for re-emergence, block the domain and IP at perimeter security controls, and alert users to the historical threat. Security teams should review logs for prior connections to 76.223.105.230 or legion.click to identify potential compromised credentials.