intro-ledgrcom[.]wixstudio[.]com

PhishDestroy identifies the domain intro-ledgrcom.wixstudio.com (seed 36b8a0) as a high-risk phishing decoy actively impersonating Ledger hardware wallet login pages to harvest cryptocurrency account credentials and seed phrases. This domain was flagged by PhishDestroy’s automated pipeline while mimicking Ledger’s official site (ledger.com) and is currently under investigation for active phishing operations. It resolves to IP 34.144.206.118 and currently shows 0/95 VirusTotal detections as of seed 36b8a0, indicating evasion of traditional AV engines. The site uses a Let’s Encrypt SSL certificate (CN: *.wixstudio.com) to appear legitimate, but the mismatch between the subdomain and Wix hosting platform raises red flags. Wix is a legitimate site-builder platform, but threat actors frequently abuse free subdomains like *.wixstudio.com to host spoofed login forms. Connection via IP 34.144.206.118—part of Google Cloud—adds to obfuscation, as cloud IPs are commonly rented by threat actors to avoid IP-based blocking. No public blocklist entries were detected at time of analysis, and trust scores (e.g., Google Safe Browsing, PhishTank) remain unflagged due to low dwell time and recent domain creation. To mitigate exposure, users should immediately block access to intro-ledgrcom.wixstudio.com at the network or DNS level using blocklists or firewall rules targeting 34.144.206.118. Avoid clicking any links or entering credentials on this domain or similar lookalike sites. Verify all crypto wallet login URLs by typing the official domain (ledger.com) manually or using bookmarks from verified sources. Enable hardware wallet security features such as passphrase protection and multi-factor authentication. Report suspicious domains to your organization’s security team or through platforms like PhishTank or Google Safe Browsing to accelerate takedown. Monitor accounts for unauthorized transactions, especially if seed phrases or private keys were entered on untrusted pages. Consider rotating all credentials and seed phrases if exposure is suspected.