legionx[.]gitbook[.]io

Analysis of legionx.gitbook.io indicates active brand impersonation targeting Google, classified as high-risk. The domain, registered on March 30, 2014, through Cloudflare, Inc., currently resolves to IP 172.64.146.167. Infrastructure analysis reveals the use of GitBook hosting, Google Cloud, Cloudflare CDN, and HTTP/3, alongside Google Trust Services for SSL certification. The page title, 'Join GitBook - GitBook,' does not explicitly confirm the impersonated brand, but the domain is flagged by one security blocklist and assigned a trust score of 0/100 by Gridinsoft. Three of 95 security vendors on VirusTotal have detected malicious activity associated with this domain. The domain remains active as of July 12, 2026, and is blocked by at least one security provider. Defenders should note the use of legitimate cloud infrastructure (Google Cloud, Cloudflare) to lend credibility to the impersonation attempt. The combination of an aged domain, low detection counts, and trusted hosting providers suggests an effort to evade automated filtering. No specific phishing kit or payload has been confirmed in the available data. Organizations are advised to block the domain and IP at the perimeter, monitor for internal access attempts, and review logs for interactions with GitBook-hosted subdomains. Further investigation into LinkedIn Ads and Google Tag Manager usage may reveal additional distribution vectors.