ledgercom[.]wixstudio[.]com

The domain ledgercom.wixstudio.com is currently offline and returns an HTTP 404 status, indicating that the site is no longer serving content. Despite the lack of a live page, the observed page title – "Official Site® | Ledger.com/Start® | Getting started" – directly mirrors Ledger’s branding, confirming a brand‑impersonation attempt aimed at the cryptocurrency hardware wallet provider. Infrastructure analysis shows the domain resolves to IP 34.144.206.118, which belongs to Google LLC (ASN 396982) in the United States. The host leverages Google Cloud services, including Google Cloud CDN and HTTP/3, and the web stack includes Wix and React, suggesting the attacker used a low‑cost website builder to host the fraudulent site.

Registration was performed through GoDaddy.com, LLC, and the TLS certificate is issued by Let’s Encrypt (R12), a free certificate authority, providing a legitimate‑looking HTTPS connection. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, indicating that at least one anti‑phishing service has identified it as malicious. VirusTotal scans report eight of ninety‑three security vendors flagging the domain, reinforcing the suspicion of malicious intent. The scam is classified as a crypto‑related scam, consistent with Ledger’s product focus.

While the site is offline, defenders should treat the domain as a confirmed impersonation threat. Recommended actions include adding the domain to internal blocklists, updating email and web filtering rules to deny traffic to the IP address and nameservers (dns1‑dns4.p08.nsone.net), and monitoring for any future re‑registration or similar domains that target Ledger’s brand. Continuous observation of GoDaddy‑registered domains using Ledger‑related keywords is advised, as the attacker may attempt to recreate the site using a different subdomain or hosting provider.