legescom[.]wixstudio[.]com

PhishDestroy identifies legescom.wixstudio.com as an active crypto drainer site, impersonating the Legescom brand to facilitate cryptocurrency theft. The domain leverages a Wix Studio hosting platform to deploy a fraudulent interface designed to trick users into connecting cryptocurrency wallets under false pretense. This type of attack typically involves malicious JavaScript payloads that monitor wallet connections and drain funds upon approval of fraudulent transactions. The site mimics a legitimate service interface to exploit user trust and bypass security awareness. Technical analysis reveals the following indicators: the domain resolves to IP 34.144.206.118 and is secured with a Let’s Encrypt SSL certificate. VirusTotal currently reports 4 out of 95 antivirus engines detecting the threat, indicating a low detection rate among security vendors. The domain is registered through Wix.com (via Wix Studio), with no public registration data available due to privacy protection. As of the latest scan, Google Safe Browsing (GSB) has not flagged the domain, and public blocklists such as PhishTank or OpenPhish show no entries. These factors suggest a recently deployed and still-evolving threat infrastructure. The domain remains active and continues to operate as a crypto drainer targeting unsuspecting users. Immediate response actions include blocking the domain at network and endpoint levels, disabling access via corporate DNS policies, and submitting the URL to threat intelligence platforms and browser security vendors. While current detection is low, the risk of financial loss is high due to the nature of crypto drainer attacks. Users are strongly advised to avoid visiting legescom.wixstudio.com and to verify any similar service through official channels before interacting. Remaining risk is classified as active and evolving, pending further takedown or detection updates.