lgnsresolve[.]live

The domain lgnsresolve.live is currently operating as a high-risk crypto drainer phishing site, specifically impersonating the LGNS Stake platform. Analysis confirms the domain remains active, presenting a fraudulent interface under the page title 'Origin — LGNS Stake' to deceive users into connecting cryptocurrency wallets. This infrastructure is designed to execute unauthorized transactions, draining funds from compromised accounts upon interaction. Infrastructure analysis reveals the domain was registered on June 06, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 216.198.79.65, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. Security telemetry indicates the domain is flagged by 4 of 95 vendors on VirusTotal and appears on three distinct security blocklists. The SSL certificate is issued by Let's Encrypt (YR2), a common characteristic observed in transient phishing campaigns. The creation date and hosting provider suggest a pattern consistent with short-lived, high-velocity phishing operations targeting cryptocurrency users. Current monitoring confirms lgnsresolve.live remains operational and unmitigated at the time of this report. Users and organizations are advised to implement immediate network-level blocking of the domain and its associated IP address. Cryptocurrency wallet providers should update their threat intelligence feeds to include this domain in real-time protection mechanisms. Individuals who may have interacted with the site should disconnect any linked wallets, revoke smart contract approvals, and monitor transaction histories for unauthorized activity. Security teams are recommended to conduct retrospective analysis for potential exposure within their environments.