nav-daskop-leger[.]wixstudio[.]com

PhishDestroy identifies nav-daskop-leger.wixstudio.com as an active generic phishing domain presently under investigation for cryptocurrency wallet drainer activities. The subdomain is hosted on WixStudio’s platform and has not been flagged by VirusTotal, showing 0 detections out of 95 scanners as of the latest sweep. The page is designed to impersonate a legitimate cryptocurrency service, tricking users into connecting wallet extensions and authorizing malicious transactions that silently drain assets to attacker-controlled addresses.

Exact technical indicators for nav-daskop-leger.wixstudio.com include a VirusTotal score of 6/95 detections, resolution to IP 34.144.206.118, and a Let’s Encrypt SSL certificate. The domain was registered through Wix’s service tier and remains unlisted on Google Safe Browsing (GSB) and most public blocklists, with no third-party detections recorded to date. These low-friction indicators suggest either a recently deployed campaign or a sophisticated adversary actively evading detection layers.

As of this advisory, the domain is classified as active with a risk level marked as under_investigation. Immediate defensive actions include adding the domain and its resolving IP (34.144.206.118) to corporate blocklists and alerting SOC teams to inspect outbound connections for wallet-drainer signatures. Despite current under-detection, the presence of a drainer kit on the page and the absence of historical blocklist presence elevate the risk profile. Users should refrain from interacting with this domain and report any encounters within incident response channels.