leggr-livehelp[.]wixstudio[.]com

This domain, leggr-livehelp.wixstudio.com, is flagged as a confirmed brand impersonation site targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the infrastructure was designed to mimic legitimate Ledger support channels, likely to deceive users into divulging recovery phrases or installing malicious software. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and naming convention align with known tactics used in wallet compromise campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered through GoDaddy.com, LLC on April 12, 2026, and resolves to the IP address 34.144.206.118. Security vendors on VirusTotal flagged the domain, with 12 out of 95 detecting malicious activity. The site employed a Let’s Encrypt SSL certificate and utilized technologies including Wix, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3. The domain appears on one security blocklist, and no Google Safe Browsing (GSB) detection was recorded at the time of assessment. The domain is currently offline, having been taken down following detection by automated phishing mitigation systems. Despite its inactive status, residual risk persists due to the potential for re-registration or migration to alternative infrastructure. Users who interacted with the site are advised to monitor wallet transactions for unauthorized activity, revoke any connected dApp permissions, and verify device integrity. Organizations should update blocklists to include the domain and associated IP address to prevent future exposure.