ledgestartedapps[.]wixstudio[.]com

PhishDestroy identifies ledgestartedapps.wixstudio.com as an active cryptocurrency drainer phishing domain masquerading as a legitimate Ledger wallet application starter. The site is currently running a Ledger-branded drainer kit that silently siphons funds from victim wallets upon transaction signing. There is no evidence yet of a dedicated malware dropper bundle, but the drainer’s scripts are obfuscated with domain-specific entropy to evade static detection engines.

Technical indicators place this campaign on the fringe of mainstream takedowns. VirusTotal records a 4/95 detection ratio across all engines, underscoring the kit’s novel obfuscation techniques. The domain is served from IP 34.144.206.118 on a WixStudio platform (registrar WixDomains Inc.) with a valid Let’s Encrypt certificate to bolster false trust. Creation date and Google Safe Browsing status are still under forensic review, but current blocklist counts remain at zero, indicating rapid deployment before global blacklisting.

The domain remains active and is being actively monitored under seed cf3fee. No official takedown has been executed; host-level blocks are the most effective immediate mitigation. Users should treat this site as hostile, cease any interaction, and alert their wallet providers if any signing activity occurred. Remaining risk is assessed as low-to-medium due to early-stage deployment and lack of sign-in telemetry, but the drainer kit’s sophistication suggests escalation is likely.