legion-1[.]gitbook[.]io

This domain, legion-1.gitbook.io, is actively impersonating Arbitrum, a known blockchain scaling solution, as indicated by its page title 'Introducing Legion | Legion' and confirmed brand impersonation classification. Registered on March 30, 2014, the domain resolves to IP address 104.18.40.47 and is hosted behind Cloudflare infrastructure, a common tactic to obscure origin and evade takedowns. Analysis reveals the use of GitBook, a legitimate documentation platform, which may lend credibility to the malicious content. The domain is assigned a trust score of 0/100, and three of 95 security vendors on VirusTotal have flagged it as malicious. It is currently listed on one security blocklist and remains active as of July 12, 2026. The SSL certificate is issued by Google Trust Services, and the site employs HTTP/3, HSTS, and Google Cloud Trace, further blending with legitimate web properties. Defenders should treat this domain as high-risk, particularly in environments where Arbitrum-related activity is monitored. Block access to 104.18.40.47 and legion-1.gitbook.io at the network perimeter, and alert users to avoid interaction with any Arbitrum-themed documentation hosted on this domain. The exact nature of the malicious content is not yet analysed, but the impersonation of a blockchain platform suggests potential credential harvesting or fraudulent token distribution schemes.