ledgr-eng[.]wixstudio[.]com

The domain ledgr-eng.wixstudio.com has been identified as a phishing site specifically targeting cryptocurrency wallet users. This domain impersonates Ledger, a well-known hardware wallet provider, by presenting a fraudulent setup portal under the page title 'Official | Lédger.com/Start®® | Getting Started®®'. The site is currently offline, but prior analysis confirms its malicious intent to harvest sensitive credentials from unsuspecting users attempting to initialize or access their wallets. Analysis indicates the domain was registered through GoDaddy.com, LLC on April 12, 2026, and resolves to the IP address 34.144.206.118. Security vendor detections are notably elevated, with 13 of 95 vendors on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist, and its trust score from Gridinsoft is 0 out of 100, indicating a high-risk classification. Infrastructure analysis reveals the use of Wix hosting services, alongside technologies such as Envoy, React, Google Cloud, Lodash, HSTS, and Google Cloud CDN, which are consistent with modern phishing campaigns leveraging legitimate cloud infrastructure to evade detection. The SSL certificate is issued by Let's Encrypt, a common tactic to lend an appearance of legitimacy. As of the latest assessment, ledgr-eng.wixstudio.com has been taken offline, likely due to takedown efforts or abandonment by the threat actor. However, the risk of similar domains emerging remains elevated. Users are advised to verify the authenticity of any Ledger-related domains by cross-referencing official communications from the vendor. Organizations should update their security blocklists to include this domain and its associated IP address. Monitoring for newly registered domains with similar naming patterns or hosting characteristics is recommended to preemptively identify related threats. End users should exercise caution when accessing wallet setup portals and prioritize direct navigation to official websites rather than following links from unverified sources.