startle-degrapp[.]wixstudio[.]com

The domain startle-degrapp.wixstudio.com has been identified as a high-risk brand impersonation resource targeting Ledger, a cryptocurrency hardware wallet provider. Analysis confirms the domain was actively impersonating the official Ledger Live application, presenting itself as "Ledger Live App® | Official Ledger Mobile" to deceive users into disclosing sensitive credentials or wallet access details. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented threat vector. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on June 11, 2026, an anomalous creation date suggesting potential domain spoofing or backdating. The resource resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employed a Let's Encrypt SSL certificate to simulate legitimacy. Detection metrics indicate the domain was flagged by 16 of 95 security vendors on VirusTotal, while appearing on three distinct security blocklists, including PhishDestroy, PhishingArmy, and OISD. Technologies detected on the domain include Wix, React, Google Cloud CDN, and HTTP/3, further aligning with modern phishing infrastructure patterns. Current status confirms the domain is offline, though residual risk persists for users who may have interacted with it prior to takedown. Organizations and individuals are advised to block the domain and associated IP 34.144.206.118 at the network perimeter. Users who accessed the resource should immediately revoke any wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Security teams are recommended to review logs for connections to the domain or IP and integrate the indicators into threat intelligence feeds for proactive defense.