connect-en-ledggr[.]wixstudio[.]com

PhishDestroy identifies connect-en-ledggr.wixstudio.com as a recently activated domain involved in a credential-harvesting operation masquerading as the legitimate Ledger cryptocurrency wallet login page. This site leverages the Wix Studio hosting platform to appear professional and evade immediate takedown, while the Let’s Encrypt SSL certificate adds an extra layer of authenticity to deceive visitors. The domain resolves to IP 34.144.206.118 and currently remains undetected by 95 VirusTotal engines, indicating it is actively bypassing signature-based defenses. This domain was flagged by PhishDestroy during routine threat hunting using seed 6705be. Threat analysis reveals it is part of a broader campaign targeting cryptocurrency users, specifically aiming to steal wallet credentials under the guise of a “Ledger connection” or “account verification” process. The site’s use of a legitimate hosting provider (Wix Studio) and trusted SSL issuer (Let’s Encrypt) demonstrates a deliberate attempt to exploit trust in well-known services. While the domain is actively resolving and serving content, there are no public indicators of compromise (IOCs) beyond the initial detection, placing its risk level under active investigation. If you have visited connect-en-ledggr.wixstudio.com, cease interaction immediately and do not enter any credentials. Disconnect from the network to prevent potential session hijacking. Scan your device with updated antivirus and change passwords for Ledger and related cryptocurrency accounts using a separate, secure device. Enable multi-factor authentication (MFA) where available and monitor financial accounts closely for unauthorized transactions. Report any suspicious activity to your wallet provider and consider revoking any potentially exposed API keys or app connections. Always verify URLs via official channels before entering sensitive information.