ldger-appstarts-en[.]wixstudio[.]com

This domain, ldger-appstarts-en.wixstudio.com, is identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics Ledger’s official setup portal, presenting a page titled 'Ledger.com/Start® | Getting started — Ledger®®' to deceive users into entering recovery phrases or private keys. The infrastructure is designed to facilitate crypto asset drainage, a common tactic in wallet impersonation schemes. No specific drainer kit signatures were detected in initial scans, but the domain’s structure and content align with known wallet phishing campaigns. Infrastructure analysis reveals the domain resolves to IP address 34.144.206.118, a host associated with cloud-based services. The domain is registered through GoDaddy.com, LLC, and employs a Let’s Encrypt SSL certificate to create a false sense of legitimacy. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists, including PhishDestroy, PhishingArmy, and OISD. No Google Safe Browsing (GSB) detection was noted at the time of assessment, though this may reflect a lag in propagation rather than a clean status. The domain’s creation date is not publicly disclosed, but its recent appearance on blocklists suggests it was operational for a limited window. The domain is currently offline, likely due to takedown actions or suspension by the hosting provider. Despite its inactive status, residual risk remains for users who may have interacted with the site during its operational period. Affected individuals should immediately revoke any connected wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Organizations and security teams are advised to add the domain and its associated IP to internal blocklists to prevent future access attempts. Continuous monitoring of similar impersonation patterns is recommended, as threat actors frequently rotate domains and infrastructure to evade detection.