ladgercomstart[.]weebly[.]com

Analysis indicates that ladgercomstart.weebly.com is an active brand-impersonation domain targeting Ledger, a hardware cryptocurrency wallet provider. The domain was created on March 29, 2006, though this registration date predates the observed malicious activity and may reflect the age of the Weebly subdomain platform rather than the campaign itself. Infrastructure analysis reveals the page resolves to 74.115.51.8, an IP address geolocated in the United States and associated with Weebly, Inc. The site presents itself as an official Ledger resource, with the page title explicitly claiming to be 'Ledger.com/start - Ledger Live Download | Official Site®,' a direct impersonation of Ledger's legitimate onboarding portal. The domain is currently active, returning an HTTP 200 status, and is secured with a Let's Encrypt SSL certificate (serial number prefix E8). It is hosted on Amazon Web Services, utilizing nameservers ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, and ns-646.awsdns. Detected technologies include Weebly, MySQL, PHP, jQuery, Google Analytics, and Cloudflare, which are consistent with a hosted phishing kit rather than a custom-built infrastructure. The domain appears on one security blocklist and is flagged by 17 of 91 security vendors in aggregated scans, though the absence of additional context limits attribution to a specific threat actor or campaign. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and confirmed presence on security blocklists. The use of a free subdomain service (Weebly) and a widely trusted SSL certificate may increase the likelihood of successful deception. Organizations are advised to block access to ladgercomstart.weebly.com at the network level and monitor for related subdomains or IP-based indicators.