legiws[.]cc

The domain legiws.cc has been identified as an active crypto drainer, a specialized form of phishing designed to target cryptocurrency users by tricking them into unknowingly approving malicious transactions. This threat vector typically involves impersonating legitimate services or brands to lure victims into connecting their wallets to fraudulent dApps or fake login portals. While no specific brand impersonation has been confirmed in the available intelligence, crypto drainers often leverage generic or newly registered domains to evade detection and exploit trust in decentralized finance ecosystems. legiws.cc exhibits multiple red flags consistent with malicious infrastructure. The domain resolves to IP address 91.238.105.104 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on October 24, 2025. Security analysis via VirusTotal reveals that 16 out of 95 vendors have flagged this domain as malicious, indicating a high confidence in its harmful nature. Additionally, it appears on 2 separate security blocklists, including OpenPhish and PhishingArmy, highlighting its prevalence in known phishing campaigns. The domain utilizes a Let's Encrypt SSL certificate, which is commonly abused by threat actors to lend an appearance of legitimacy to their infrastructure. As of the latest assessment, legiws.cc remains active and unblocked by many endpoint solutions despite its detection history. PhishDestroy has marked this domain with an elevated risk rating, and immediate action is advised for users who may have encountered it. Users should avoid interacting with the domain under any circumstances and verify its status through trusted platforms like PhishDestroy. The risk of exposure persists due to the domain's recent registration and the involvement of a registrar known for lax oversight, though the active blocklisting by multiple sources suggests some defensive coverage. Organizations are urged to update their threat intelligence feeds and security controls to include this domain and its associated IP address to prevent potential compromise.