legdeliveapps[.]wixstudio[.]com

The domain legdeliveapps.wixstudio.com has been flagged by PhishDestroy for hosting a generic phishing campaign designed to deploy a crypto drainer kit. Threat analysis indicates this infrastructure is actively mimicking the official Ledger Live application, likely targeting cryptocurrency users with deceptive download prompts or fake login portals. The seed identifier 21f889 ties this domain to a coordinated campaign aimed at siphoning funds from unwary victims through fake transaction confirmations or credential harvesting. No specific drainer kit variant has been confirmed at this stage, but the infrastructure’s behavior aligns with known tactics such as clipboard manipulation, fake wallet approvals, and malicious browser extension distribution.

Technical indicators associated with this domain are as follows: VirusTotal currently shows 4/95 security engines detecting the threat, indicating this domain remains under the radar of mainstream antivirus solutions. The domain resolves to IP address 34.144.206.118 and is registered under the Wix Studio platform, a common hosting provider exploited for such campaigns. The SSL certificate is issued by Let’s Encrypt, a free certificate authority often leveraged to lend a false sense of legitimacy to malicious sites. The domain appears on 1 security blocklist, including PhishingArmy’s feed, while Google Safe Browsing (GSB) has not yet flagged this domain. The creation date and registrar details remain unverified at this time, but the active SSL certificate suggests recent deployment.

The current status of legdeliveapps.wixstudio.com is classified as active and under investigation, with no formal takedown action taken yet. PhishDestroy has flagged this domain for its association with seed 21f889, which links it to a broader campaign observed in recent threat intelligence reports. Users are advised to avoid interacting with this domain and to verify any unexpected cryptocurrency-related communications through PhishDestroy’s platform. The remaining risk is elevated due to the domain’s low detection rate on VirusTotal and its active status, meaning it could continue to operate undetected for an extended period. Organizations should monitor outbound connections to this IP and domain, and implement network-level blocking where feasible to mitigate exposure.