legerstart[.]wixstudio[.]com

PhishDestroy identifies legerstart.wixstudio.com as an active cryptocurrency drainer site impersonating the Ledger hardware wallet ecosystem. This domain was flagged for hosting a browser-based wallet drainer kit designed to siphon funds from unsuspecting victims under the guise of legitimate wallet authentication or transaction verification. The infrastructure leverages Wix’s subdomain hosting to obscure malicious intent, exploiting trust in the Wix platform while targeting crypto users familiar with Ledger devices. No specific drainer kit variant was isolated during initial analysis, but behavioral indicators suggest a generic clipboard-hijacking or fraudulent wallet interface mechanism typical of Ledger-themed scams. This domain resolves to IP 34.144.206.118 and utilizes a Let’s Encrypt SSL certificate, which increases its perceived legitimacy. VirusTotal currently shows 9/95 detections, indicating it remains undetected by most antivirus engines. The domain is registered via Wix (as a WixStudio subdomain), which complicates takedown efforts due to shared hosting environments. Current WHOIS data places the domain under Wix’s infrastructure, with no publicly visible creation date through standard queries. Google Safe Browsing (GSB) status and third-party blocklist counts are currently under verification; no entries were found in PhishTank or OpenPhish at time of analysis. As of this report, legerstart.wixstudio.com remains active and is actively distributing phishing links via social engineering campaigns targeting Ledger users. Immediate response actions include issuing a GSB block request and coordinating with Wix abuse channels to suspend the subdomain. However, due to Wix’s shared hosting model, residual risk persists through mirror domains or rapid re-registration. Users are strongly advised to verify all wallet URLs manually, avoid clicking unverified links, and report suspicious domains to PhishDestroy for continuous monitoring. Remaining risk is assessed as MEDIUM-HIGH due to the active nature of the campaign and low detection coverage.