leapwallet[.]lu

leapwallet.lu was registered on 21 February 2026 and is currently classified as an active crypto drainer with a high risk rating. The domain returns HTTP 200 responses and presents the page title “leapwallet.lu”. No additional page content has been publicly disclosed, so the exact malicious flow remains unverified. The domain resolves to the IPv4 address 66.29.148.152, which is hosted by Namecheap, Inc. in the United States. The TLS certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, indicating a valid‑looking HTTPS endpoint. Reputation services list the domain on five blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura. VirusTotal records seven out of ninety‑five scanners flagging the domain as malicious, and AlienVault OTX references it in one threat pulse. Gridinsoft assigns a trust score of 0 out of 100. Analysis indicates the primary malicious purpose is cryptocurrency theft, as reflected by the “cryptocurrency” scam type label. The combination of a recent registration, a low trust score, multiple blocklist listings, and partial detection by VirusTotal suggests a coordinated campaign aimed at draining crypto assets. However, the absence of detailed page analysis prevents confirmation of specific tactics such as credential harvesting or wallet address substitution. Defenders should immediately block both the domain and the associated IP address at perimeter and DNS layers. Continuous monitoring of outbound traffic for connections to 66.29.148.152 is advised, as is the inclusion of the domain in internal threat intelligence feeds. Given the active status, periodic re‑assessment of VirusTotal and other scanners is recommended to capture any evolution of the payload.