legerrstart[.]wixstudio[.]com

PhishDestroy identifies the active domain legerrstart.wixstudio.com as a crypto drainer campaign currently under investigation. This Wix-hosted site is being operated to deceive users into connecting cryptocurrency wallets under false pretenses, with the threat classified as an active generic phishing operation. The infrastructure is live and remains unblocked across most detection platforms as of the latest scan cycle.

Technical analysis reveals this domain resolves to IPv4 address 34.144.206.118 and is secured using a Let’s Encrypt SSL certificate. Current VirusTotal analysis shows zero detections across 95 participating security vendors, indicating low signature-based detection coverage. WHOIS data indicates the domain was registered via Wix.com Registrar, though specific creation date and blocklist inclusion metrics are not publicly disclosed at this stage. Trust and reputation scores remain unquantified due to limited historical visibility, increasing the risk of delayed detection by end users and automated defenses.

This domain is classified as ACTIVE and poses a HIGH RISK to cryptocurrency users due to the nature of crypto drainer operations, which often result in irreversible wallet asset theft. Users are advised NOT to interact with any links, QR codes, or wallet connection prompts associated with this domain. Security teams should implement network-level blocking for IP 34.144.206.118 and domainlegerrstart.wixstudio.com, and monitor for related infrastructure expansion. Exercise heightened caution with Wix subdomains hosting financial or crypto-related content, especially those using free hosting platforms.