open-startledgr[.]wixstudio[.]com

This domain is flagged as a high-risk brand_impersonation threat targeting Ledger, a hardware wallet provider. The site mimics the legitimate Ledger.com/Start onboarding portal, a critical entry point for users configuring cryptocurrency security devices. Analysis indicates the domain was designed to harvest recovery phrases, private keys, or credentials under the guise of a trusted setup process, posing severe financial and operational risks to victims. Infrastructure analysis reveals the domain open-startledgr.wixstudio.com was registered through GoDaddy.com, LLC on December 17, 2016, though recent malicious activity suggests compromise or repurposing. It resolves to IP address 34.144.206.118 and uses a Let's Encrypt SSL certificate, which provides HTTPS encryption but does not validate legitimacy. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists: PhishDestroy, PhishingArmy, and OISD. The page title, "Ledger.com/Start® | Getting started — Ledger®," precisely replicates the legitimate portal, increasing the likelihood of successful deception. Mitigation requires immediate action from both network defenders and end-users. Network administrators should block the domain and its resolving IP (34.144.206.118) at the perimeter, and monitor for internal connections to these indicators. Security teams should review logs for prior interactions with open-startledgr.wixstudio.com, particularly from systems handling cryptocurrency or financial operations. End-users should be alerted to verify domain authenticity before entering sensitive information, especially during device setup. Organizations should enforce multi-factor authentication and phishing-resistant authentication methods for all cryptocurrency-related accounts. Post-incident, affected users should revoke compromised credentials, rotate recovery phrases, and audit transaction histories for unauthorized activity.