ledgr-global[.]wixstudio[.]com

PhishDestroy identifies ledgr-global.wixstudio.com as an active fake Ledger wallet phishing domain (risk level: under_investigation) designed to steal cryptocurrency credentials. This WixStudio-hosted page mimics the official Ledger wallet interface to trick users into inputting recovery phrases or seed phrases, which attackers harvest to drain cryptocurrency funds. The threat is particularly insidious for users unfamiliar with Ledger’s branding or those expecting a legitimate crypto wallet service. Given the domain’s recent activation and SSL certificate status, users should treat it as a high-alert threat until further investigation confirms its takedown.

This domain was flagged with 0 detections out of 95 VirusTotal engines as of the latest scan, indicating it has not yet been widely blacklisted despite active distribution. It resolves to IP address 34.144.206.118, which is associated with Wix’s cloud hosting infrastructure. The domain employs a Let’s Encrypt SSL certificate, likely to appear legitimate and evade browser security warnings. Notably, no known blocklists currently list this domain, and trust scores remain unverified due to its recent registration. The seed identifier d41c7a suggests this may be part of a larger campaign, though no associated infrastructure has been linked publicly.

Mitigation for fake Ledger wallet phishing requires immediate user caution. Avoid interacting with this domain or any page hosted on wixstudio.com claiming to be Ledger. Only access Ledger services via the verified domains ledger.com or ledger-live.com. Users who may have entered credentials should immediately revoke wallet access, transfer funds to a new wallet, and perform a factory reset on any device used to access the phishing page. Report suspicious activity to Ledger support and consider enabling multi-factor authentication across all crypto accounts. Organizations should block the IP 34.144.206.118 at the firewall level and monitor internal networks for traffic to this host.