live-ledgrro[.]wixstudio[.]com

PhishDestroy identifies the domain live-ledgrro.wixstudio.com as an active crypto drainer phishing campaign under investigation. The threat involves unauthorized cryptocurrency fund extraction through fraudulent transaction prompts. Initial analysis flags the site as a high-risk payload distribution point with confirmed SSL encryption, suggesting an attempt to appear legitimate to potential victims.

This domain resolves to IP address 34.144.206.118 and is currently hosted on Wix’s platform via wixstudio.com. The SSL certificate is issued by Let’s Encrypt, indicating HTTPS support to build user trust. As of current scanning, VirusTotal reports 0 detections out of 95 engines—highlighting the recent emergence and limited signature coverage. No blocklist entries or trust score data are publicly available at this stage, emphasizing the importance of proactive monitoring and user awareness.

Given the domain’s active status and the specific threat of crypto draining, users should immediately avoid any interaction, including clicking, downloading, or entering wallet credentials. Sites with this behavior often masquerade as legitimate services (e.g., wallet interfaces or NFT platforms) and inject malicious scripts to intercept private keys or approve unauthorized transactions. If exposed, immediately revoke any unauthorized transaction approvals, transfer remaining assets to a newly generated address, and monitor blockchain activity. Report the domain to your antivirus provider and relevant crypto platforms (e.g., MetaMask, Ledger) as a known drainer.