# PhishDestroy threat dossier — getstarted-ledgre.wixstudio.com ================================================================ Fetched: 2026-07-08 13:43:03 UTC Canonical: https://phishdestroy.io/domain/getstarted-ledgre.wixstudio.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 62/100 (PhishDestroy scoring — see methodology below) Targeted brand: Ledger ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Certego, Cluster25, ESET, Gridinsoft Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 34.144.206.118 (US, Kansas City) ASN: ASAS396982 GOOGLE-CLOUD-PLATFORM - Google LLC, US Hosting org: AS396982 Google LLC Registrar: GoDaddy.com, LLC Nameservers: ["dns1.p08.nsone.net", "dns2.p08.nsone.net", "dns3.p08.nsone.net", "dns4.p08.nsone.net"] Page title: Getting started®| Ledger.com/Start® — Official ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-22 Status: INVALID chain Fingerprint: 4d824d023de01f229e601938edcdb7020802d167c0d85fac21c644cf194c9450 Subject Alternative Names (related infrastructure — often same operator): - wixstudio.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-04 14:39:38 UTC (by PhishDestroy tracker) Last verified: 2026-07-08 12:20:35 UTC Neutralised: 2026-07-04 18:17:26 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f2d23-66cc-75cd-b7ac-035013f1e05c/ Wayback Machine: https://web.archive.org/web/*/getstarted-ledgre.wixstudio.com crt.sh CT logs: https://crt.sh/?q=%25.getstarted-ledgre.wixstudio.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=getstarted-ledgre.wixstudio.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/getstarted-ledgre.wixstudio.com URLhaus: https://urlhaus.abuse.ch/host/getstarted-ledgre.wixstudio.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-04 14:54:31 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain getstarted-ledgre.wixstudio.com has been identified as part of a credential theft scheme and its operational status is currently active. Ongoing analysis suggests the site may be engaging in brand impersonation, potentially targeting users of a well-known cryptocurrency wallet platform based on domain naming conventions. The infrastructure leverages common web technologies, including Wix, React, and Google Cloud services, which may be used to facilitate a deceptive user interface designed to harvest sensitive credentials from unsuspecting victims. Technical review of this domain reveals that it is hosted at IP address 34.144.206.118 and uses a Let's Encrypt SSL certificate, providing encrypted communication. At the time of analysis, the domain is not flagged by any major security providers, with 0 out of 95 vendors marking it as malicious according to VirusTotal data. No blocklist records or trust score reductions have been observed. The current registrar is associated with web hosting platforms that allow rapid site deployment. Creation date and further registration details are not available in the provided dataset, but the presence of HTTP/3 and Google Cloud CDN indicates modern hosting infrastructure, increasing the likelihood of scalability and resilience against takedown attempts. As of this report, getstarted-ledgre.wixstudio.com remains active and continues to pose a risk for credential theft. Security teams should monitor for traffic to this domain and consider implementing preventive controls such as DNS filtering or network-level blocks. End users are advised to avoid interacting with the site, especially if prompted for credentials or wallet recovery information. Incident response teams should document any attempted access and update detection signatures to reflect the domain’s indicators of compromise. Continuous monitoring for updates in security vendor databases and public blocklists is recommended as the situation evolves. [Updates since narrative was generated:] - Public blocklists: now listed on 1 feed ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: f4feb61d53bc0de67557513853fa54f1 TLS cert SHA-256: 4d824d023de01f229e601938edcdb7020802d167c0d85fac21c644cf194c9450 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/getstarted-ledgre.wixstudio.com/ JSON API: https://api.destroy.tools/v1/check?domain=getstarted-ledgre.wixstudio.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 176,186 domains (13,330 alive under monitoring, 161,869 confirmed takedowns/dead). Site: https://phishdestroy.io