ldger-appstarts-eng[.]wixstudio[.]com

This domain, ldger-appstarts-eng.wixstudio.com, presents a brand impersonation threat targeting users of the Ledger cryptocurrency hardware wallet. The site mimics the official Ledger.com/Start onboarding portal, a critical entry point for wallet initialization and seed phrase generation. Analysis of the page title, 'Ledger.com/Start® || Getting started™,' indicates an attempt to deceive users into entering sensitive recovery phrases or private keys under the false pretense of legitimate wallet setup procedures. Such attacks are designed to harvest cryptographic credentials, enabling unauthorized access to digital assets stored in Ledger devices. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered through GoDaddy.com, LLC on June 11, 2026, and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. Security vendors have flagged the domain, with 14 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on one security blocklist and is currently blocked by PhishDestroy. The site employed Let's Encrypt SSL certificates, React, RequireJS, and Lodash, alongside Google Cloud CDN and HTTP/3, suggesting a sophisticated hosting environment designed to evade detection. Users who accessed ldger-appstarts-eng.wixstudio.com should assume potential exposure of sensitive credentials. Immediate actions include revoking any entered recovery phrases or private keys, monitoring associated cryptocurrency wallets for unauthorized transactions, and generating new seed phrases for affected devices. Devices used to access the domain should undergo malware scans to detect secondary payloads. Organizations should update internal blocklists to include this domain and its resolving IP address, while end-users should verify the authenticity of Ledger-related communications through official channels only.