startcom-ledagr[.]wixstudio[.]com

PhishDestroy identifies startcom-ledagr.wixstudio.com as a fraudulent Ledger wallet phishing domain designed to deceive users into surrendering cryptocurrency credentials through a spoofed web interface. The site leverages a WixStudio-hosted page to mimic official Ledger wallet authentication flows, likely employing a drainer script to siphon funds from compromised wallets. No specific drainer kit fingerprint was identified in initial scans, but the site’s structure suggests cloning of Ledger’s web wallet interface.

This domain resolves to IP 34.144.206.118 and is secured with a Let’s Encrypt SSL certificate. VirusTotal currently reports 5/95 detections, indicating it remains largely undetected by antivirus engines as of this report. The domain was registered under Wix.com’s platform (WixStudio), a common hosting service for phishing pages due to its legitimate infrastructure abuse. The SSL certificate suggests an attempt to appear trustworthy, though issuance by Let’s Encrypt does not guarantee legitimacy. GSB (Google Safe Browsing) status remains unverified in public sources, and no blocklist count is publicly documented at this time.

The site remains active with an 'under_investigation' status, indicating ongoing scrutiny by threat intelligence platforms. Response actions include IP/network flagging and continued monitoring for payload delivery or wallet drainer updates. While the immediate risk is elevated due to the lack of AV detections, the site’s reliance on WixStudio hosting and generic SSL may limit its operational lifespan. Users are advised to avoid interacting with this domain, verify wallet URLs via official Ledger channels, and report any suspicious activity immediately. Remaining risk is moderate due to undetected status and potential for delayed takedown.