startledge-enusapp[.]wixstudio[.]com

startledge-enusapp.wixstudio.com is an inactive web presence that was used to impersonate Ledger’s onboarding portal. The site was created on 17 December 2016 through GoDaddy.com, LLC and is hosted on Google Cloud infrastructure (AS396982, United States). DNS resolves to 34.144.206.118 and presents a Let’s Encrypt R13 certificate; an HTTP request returns a 404 status, indicating the original content is no longer publicly reachable. The page title captured during earlier analysis reads “Ledger.com/Start® | Getting started — Ledger®®”, matching the legitimate Ledger branding and reinforcing the impersonation intent.

Technical fingerprints reveal the use of Wix’s site builder, a React front‑end, Lodash, HTTP/3, HSTS, and Google Cloud CDN, a combination frequently observed in credential‑harvesting kits. Nameservers are dns1‑4.p08.nsone.net, consistent with the registrar’s DNS configuration. The domain appears on a single security blocklist and was flagged by PhishDestroy. VirusTotal scans show six of ninety‑one AV engines flagged the host, confirming malicious suspicion.

Evidence of the phishing kit or the exact payload has not been recovered, and the site’s current offline state limits real‑time observation. Defenders should ensure that the domain is blocked at network perimeter and endpoint filters, monitor for any resurgence of the same sub‑domain pattern, and educate users that legitimate Ledger communications never originate from a wixstudio.com address. Ongoing vigilance for similar Ledger‑related impersonation campaigns is advised.