startapp-eng[.]wixstudio[.]com

This domain, startapp-eng.wixstudio.com, is identified as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The domain was designed to mimic the official Ledger setup portal, specifically replicating the "Ledger.com/Start" onboarding process. Analysis confirms the page title displayed as "Official Site® — Ledger.com/Start® || Getting started®", a deliberate attempt to deceive users into believing they were accessing legitimate Ledger resources. The domain is currently offline, though prior activity suggests it was actively used for credential harvesting or malicious payload distribution. Infrastructure analysis reveals the domain resolved to IP address 34.144.206.118, hosted on Google Cloud infrastructure with HTTP/3 and Google Cloud CDN enabled. The domain was registered through GoDaddy.com, LLC and secured with a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy. Security vendor detection on VirusTotal indicates 15 of 95 engines flagged the domain as malicious, while it appeared on one security blocklist. Google Safe Browsing classified the domain under "SOCIAL_ENGINEERING", further corroborating its fraudulent intent. Technologies detected on the domain include Wix, Envoy, and React, suggesting a templated or low-effort deployment typical of phishing campaigns. The domain has since been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure and registration patterns observed may resurface in future campaigns. Organizations and users are advised to monitor for similar domains leveraging cloud hosting, Let's Encrypt certificates, and brand-specific keywords (e.g., "start", "setup"). Network-level blocking of the IP 34.144.206.118 is recommended for proactive defense. End users should verify domain authenticity by cross-referencing official Ledger communications and avoiding links from unsolicited emails or search results. Security teams should prioritize detection rules for domains impersonating cryptocurrency hardware providers, particularly those mimicking onboarding or recovery workflows.