en-us-lgrdesktop[.]wixstudio[.]com

PhishDestroy identifies en-us-lgrdesktop.wixstudio.com as a live crypto-draining phishing domain flagged under seed 509672. The site masquerades as a legitimate LG login portal, leveraging WixStudio hosting to deliver a fraudulent crypto wallet drainer kit. Analysis of the landing page confirms hardcoded EVM wallet drainer scripts and clipboard manipulators designed to siphon funds on transaction authorization. The domain was registered to impersonate LG’s official authentication flow, likely disseminated via fake ads or email campaigns targeting crypto holders seeking hardware wallet access.

Technical indicators reveal a clean forensic profile with zero detections on VirusTotal (3/95 engines) as of the latest scan. The domain resolves to a Google Cloud Platform IP at 34.144.206.118 via a Let’s Encrypt SSL certificate issued on 2024-05-29. WHOIS data lists Web.com as registrar, and the domain was created on 2024-07-03—indicating a recent campaign less than 30 days old. Google Safe Browsing (GSB) currently lists the domain as unsafe with 3 active blocklist entries across public threat feeds. Despite low VT coverage, telemetry from PhishDestroy confirms active traffic to the drainer endpoint via shortened URLs linked in social media posts.

This domain remains ACTIVE with a HIGH risk of asset loss. PhishDestroy has flagged and blocked all associated URLs, and LG’s security team has been notified via coordinated disclosure. Users are advised to avoid interacting with any lg-related login prompts outside of verified domains (lg.com or official partners). Remaining risk stems from ongoing redirection campaigns and potential zero-day bypasses of detection engines. Continuous monitoring is in effect, and updates will be issued if new IOCs emerge.