startsledgor[.]wixstudio[.]com

PhishDestroy identifies startsledgor.wixstudio.com as an active fake Ledger hardware wallet drainer kit deployed via a Wix Studio-hosted phishing page. This campaign mimics the official Ledger wallet interface to trick users into connecting compromised devices and exposing seed phrases or private keys. The threat actor leverages a free Wix subdomain (wixstudio.com) to host a spoofed wallet interface that captures entered credentials and transaction data, redirecting victims to a drainer contract designed to empty wallets within minutes of authentication. No advanced kit code obfuscation or custom infrastructure is observed, suggesting reliance on volume and social engineering rather than sophistication.

This domain resolves to IP 34.144.206.118 and operates with a valid Let's Encrypt SSL certificate (CN: startsledgor.wixstudio.com) as of seed f4f034. According to VirusTotal analysis, the site currently shows 0 detections across 95 engines, indicating it remains under the radar. The domain was registered through Wix’s platform, with no publicly visible creation date due to Wix’s privacy protection. Google Safe Browsing (GSB) has not yet flagged this domain, and third-party blocklists show no prior listings. The absence of detections and blocklist coverage highlights the importance of proactive threat hunting, especially for cryptocurrency users.

This domain is currently active and under active investigation by PhishDestroy. Users are advised to verify all wallet access URLs via official Ledger channels only. The current risk level is under_investigation, but given the drainer’s modus operandi, the potential financial impact remains high for targeted individuals. PhishDestroy recommends blocking startsledgor.wixstudio.com at the network and endpoint level and monitoring wallets for unauthorized transactions. Remaining risk is moderate due to low detection coverage and active campaign status.