ledgir-homepage[.]wixstudio[.]com

PhishDestroy identifies ledgir-homepage.wixstudio.com as a live crypto drainer phishing domain currently under investigation, exhibiting active malicious behavior. This domain is engineered to deceive users into connecting cryptocurrency wallets under the guise of a legitimate service, with the intent to drain funds through unauthorized transactions. The risk level remains classified as under_investigation due to evolving threat signatures and incomplete behavioral telemetry, but the presence of a crypto drainer payload elevates the immediate danger to users engaging with the site. This domain resolves to the IP address 34.144.206.118 and is hosted on the WixStudio platform, utilizing a Let's Encrypt SSL certificate to appear legitimate. Despite zero detections on VirusTotal (4/95 engines), the absence of flagging does not equate to safety, as many crypto drainers evade detection through polymorphic code and rapid infrastructure changes. The domain’s infrastructure shows no current presence on major blocklists, and trust scores remain uncalculated due to its recent activity. PhishDestroy’s seed identifier (7006b1) confirms this is a tracked variant of a broader campaign targeting crypto users via spoofed portfolio or exchange interfaces. Mitigation requires immediate action: users must avoid interacting with ledgir-homepage.wixstudio.com entirely. If a wallet connection was initiated, revoke permissions immediately via the wallet’s interface and transfer remaining assets to a new wallet. Organizations should block the domain at the network level and update endpoint protection rules to flag similar Wix-hosted crypto-themed domains. Always verify URLs through trusted sources like PhishDestroy before entering credentials or connecting wallets, and enable multi-factor authentication on all crypto accounts. Monitor transaction histories for unauthorized transfers and report any suspicious activity to relevant exchanges or wallet providers.