leggatonexus[.]com

This domain, leggatonexus.com, is currently under investigation for generic phishing activity as of July 12, 2026. Infrastructure analysis reveals the domain was registered on November 13, 2025, through Squarespace Domains LLC, a registrar commonly associated with both legitimate and malicious domains. The domain resolves to the IP address 198.18.2.42, which has been referenced in 23 threat intelligence pulses on a widely used threat intelligence platform, suggesting prior associations with malicious activity. However, no specific details regarding the nature of these pulses or the entities involved are available at this time. The domain appears on two security blocklists, indicating preliminary detection by at least two independent security providers. Despite this, automated scanning tools report zero detections out of 95 engines, which may reflect either the domain's recent activation or the use of evasion techniques. The SSL certificate is issued by Let's Encrypt, a common provider for both benign and malicious sites, and does not provide definitive evidence of intent. Technologies detected on the domain include Squarespace Commerce and HSTS, which are consistent with a web storefront but do not rule out malicious use. The page title, 'Em breve,' suggests the site may be targeting Portuguese-speaking users, though the exact content and intent remain unconfirmed. No specific brand impersonation or scam category has been identified in the available data. The domain remains active, and its trust score is currently assessed at 0 out of 100 by one security vendor, reinforcing the need for caution. Defenders are advised to monitor network traffic for connections to 198.18.2.42 and consider blocking the domain at the perimeter until further analysis confirms its legitimacy or malicious nature. Additional investigation is required to determine the precise threat vector and potential impact.