ftp[.]legionliberty[.]com

Analysis of ftp.legionliberty.com shows a domain created on February 28, 2026 and currently taken offline. The domain resolves to IP address 45.147.197.190, which is assigned to ASN 204601 (NovoServe B.V.) in the Netherlands. Hosting is protected by DDoS-Guard, and the DNS infrastructure uses four nameservers operated by the Zomro network (ns1.zomro.net, ns2.zomro.ru, ns3.zomro.com, ns4.zomro.su). The site presented a simple page title of "Welcome!" and employed a Let’s Encrypt R13 certificate, indicating that TLS was correctly configured during its active period.

Registrant information lists NameCheap, Inc. as the registrar. VirusTotal scans flagged the domain in 12 of 93 security vendors, and the domain appears on a single external blocklist. PhishDestroy has explicitly blocked the domain, and Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. The combination of a recent creation date, low vendor detection count, presence on a phishing blocklist, and a zero trust score aligns with the classification of a generic phishing operation.

Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole configurations, and monitor outbound traffic for any residual connections to 45.147.197.190. Given the domain is offline, threat actors may repurpose the same infrastructure for future campaigns; therefore, maintaining the blocklist entry and periodically re‑scanning the IP address and associated nameservers is advisable. No additional indicators such as payload samples or compromised credentials have been released, so further intelligence gathering should focus on correlating any observed traffic to the known IP or nameserver set with existing incident data.