ledegercom-starts[.]wixstudio[.]com

A recently activated phishing domain impersonating Ledger’s official platform has been flagged by PhishDestroy. Hosted on wixstudio.com, ledegercom-starts.wixstudio.com mimics the legitimate ledger.com service to harvest cryptocurrency wallet credentials and seed phrases from unwitting users. This domain specifically targets users through social engineering, deploying a convincing login portal to steal sensitive blockchain access keys. The attack vector relies on visual deception rather than exploiting software vulnerabilities, tricking visitors into entering recovery phrases under the guise of a supposedly secure setup or account recovery process. Analysts have identified several red flags associated with this campaign. The domain currently resolves to 34.144.206.118 and operates using a legitimate SSL certificate issued by Let’s Encrypt, which may help it bypass basic browser warnings. As of the latest scan, VirusTotal reports 0 detections out of 95 scanners, indicating it has not yet been widely blacklisted despite active hosting. The domain utilizes a Wix-hosted subdomain (wixstudio.com), which is commonly abused in low-cost, short-lived phishing operations due to the platform’s ease of deployment and minimal cost. Full behavioral analysis suggests the phishing page dynamically interacts with backend servers to validate entered seed phrases in real time, enabling attackers to immediately compromise wallets upon submission. Users who have encountered this or similar Ledger-themed scams should take immediate precautions. If you visited ledegercom-starts.wixstudio.com and entered any wallet recovery phrases, seed words, or private keys, assume your assets are at risk and transfer funds to a new, secure wallet immediately. Disable any connected applications, revoke session tokens via blockchain explorers, and reset all associated email and 2FA credentials. Report the incident to your wallet provider and consider filing a complaint with law enforcement or relevant cybercrime units such as the FBI IC3 or local cybersecurity authorities. Monitor your blockchain addresses for unauthorized transactions and remain vigilant for follow-on spear-phishing attempts targeting your recovery data.