legastrade[.]com

This domain, legastrade.com, was observed hosting a page titled “LEGAS — AI Trading Engine | Powered by Precision & Intelligence”. The site was registered on November 16, 2025 through HOSTINGER operations, UAB and is served from the IPv6 address 2a02:4780:2b:2029:0:213b:8d9:2, which maps to the United States under AS47583 Hostinger International Limited. No TLS certificate was presented, indicating the service was delivered over plain HTTP. VirusTotal analysis recorded 2 detections out of 95 scanners, confirming that at least a small subset of security products identified malicious behavior. The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, both of which classify it as a wallet/seed phishing source.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low credibility of the infrastructure. The authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com, typical of parked or temporary hosting. AlienVault OTX references include three threat‑intelligence pulses that reference the same indicator set, further corroborating its inclusion in broader threat‑sharing feeds. The current HTTP response indicates the site has been taken offline, yet the underlying infrastructure remains resolvable and may be re‑activated. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms because the page content has not been captured.

The elevated risk rating reflects the combination of credential‑stealing intent, low trust score, and presence on multiple blocklists. Because the site is offline, immediate exploitation is unlikely, but the infrastructure may be repurposed for future campaigns targeting cryptocurrency wallets. Defenders should block the IPv6 address and the domain at DNS and proxy layers, add the domain to internal blocklists, and monitor for any resurgence of the host name or associated IP range.