appstarts-ledgrcdn[.]wixstudio[.]com

PhishDestroy identifies appstarts-ledgrcdn.wixstudio.com as an active crypto-draining phishing site under ongoing investigation. The domain is engineered to mimic Ledger Live and siphon cryptocurrency from unwary users who enter their seed phrases or connect wallets. Because wallet drainage is instant and irreversible, this threat is classified as high-risk while further intelligence is collected. This domain resolves to a single IPv4 address (34.144.206.118) hosted on Google Cloud Platform. At the time of analysis, VirusTotal returned zero detections out of 95 engines—indicating the site remains under the radar of most scanners. The SSL certificate is issued by Let’s Encrypt, a trusted CA, which helps the phishing page evade browser warnings. The Wix Studio subdomain structure is commonly abused for quick site deployment, and no public blocklist entries were located at the time of reporting. Mitigation steps for this crypto-drainer threat are immediate and specific. Users must never enter seed phrases or connect wallets on any domain not explicitly verified by the official Ledger website or Ledger Live application. Bookmark the authentic URLs in advance and cross-check every link against PhishDestroy before clicking. If you have already interacted with the domain or entered credentials, revoke wallet permissions immediately via your wallet’s connected-app dashboard, transfer remaining funds to a new address, and run a malware scan on all connected devices. Report the domain to PhishDestroy and your wallet provider to accelerate takedown efforts.