startledh[.]ac

This domain, startledh.ac, is identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site masqueraded as the official Ledger Live application, presenting a fraudulent interface to deceive users into entering sensitive credentials or wallet recovery phrases. No explicit crypto drainer kit signatures were detected, but the domain’s design and page title align with tactics commonly used in credential harvesting and wallet compromise schemes. Infrastructure analysis reveals the domain was registered on November 28, 2025, through NiceNIC International Group Co., Limited. It resolved to the IP address 104.21.15.203, associated with Cloudflare, Inc. (AS13335) in the United States. The domain lacks an SSL certificate, increasing the risk of interception or tampering during data transmission. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious. It appears on one security blocklist and is currently blocked by PhishDestroy. No entries were found in Google Safe Browsing at the time of analysis. The domain is now offline, reducing immediate exposure risk. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. Users who interacted with the domain prior to takedown may still be at risk of follow-up attacks, including phishing emails or malware distribution. Organizations and individuals are advised to monitor for unauthorized access attempts, revoke any exposed credentials, and implement multi-factor authentication for cryptocurrency-related accounts. Network-level blocking of the domain and associated IP is recommended for proactive defense.