nav-ledgrlivelogn[.]wixstudio[.]com

PhishDestroy identifies nav-ledgrlivelogn.wixstudio.com as an active cryptocurrency drainer scam impersonating a login portal. This malicious domain leverages deceptive naming conventions to trick users into entering wallet credentials or initiating unauthorized transactions. While the exact drainer kit remains unverified, the presence of a Let's Encrypt SSL certificate suggests a facade of legitimacy to lower victim suspicion. The domain’s structure, combining 'nav', 'ledger', 'live', and 'login', mirrors legitimate crypto service branding, indicating a deliberate attempt at brand impersonation targeting cryptocurrency users.

Technical analysis reveals this domain resolves to IP 34.144.206.118 and currently exhibits 0 detections out of 95 scans on VirusTotal, highlighting its stealthy nature. The domain is hosted on WixStudio, a legitimate platform often exploited by threat actors for phishing campaigns due to its free-tier accessibility. Registration details remain obscured (likely privacy-protected), and the domain’s creation date is not publicly disclosed. Google Safe Browsing (GSB) has not flagged this domain, and blocklist aggregators show no entries as of this advisory. The absence of detections underscores the domain’s recency and the need for proactive monitoring.

This domain remains active and under investigation, with an elevated risk due to its cryptocurrency-focused lure. Users should avoid all interactions, including clicking links or entering credentials. Defenses are advised to block the domain and IP (34.144.206.118) at the network perimeter. Given the 3/95 VT score, organizations should prioritize behavioral analysis and sandboxing for further intelligence. Remaining risk is assessed as moderate-high due to the domain’s active status and lack of widespread detection, warranting immediate containment actions.