ledgrapp[.]wixstudio[.]com

Analysis of ledgrapp.wixstudio.com shows a confirmed Ledger brand impersonation campaign that was taken offline as of the report date, July 22, 2026. The domain was registered on March 24, 2026 through GoDaddy.com, LLC and resolves to the Google Cloud IP address 34.144.206.118, located in the United States. Infrastructure inspection reveals the site was built on Wix with a React front end, served via Google Cloud and Google Cloud CDN, and supported HTTP/3. The TLS certificate is provided by Let’s Encrypt, indicating a valid, publicly trusted HTTPS endpoint at the time of observation.

The page title returned by the server is "404 Error: Page Not Found | Wix Studio", and the HTTP response code is 404, suggesting the malicious landing page has been removed or is no longer accessible. Security telemetry shows the domain is listed on a single blocklist and was blocked by PhishDestroy. VirusTotal scans recorded four positive detections out of ninety‑four antivirus engines, reinforcing the malicious classification. The authoritative nameservers are dns1.p08.nsone.net through dns4.p08.nsone.net.

While the current offline status limits immediate threat exposure, the presence of brand‑specific impersonation indicates a potential broader campaign targeting Ledger users. Defenders should proactively add the domain and its associated IP address to outbound deny lists, monitor for new subdomains or similarly structured URLs hosted on the same nameserver set, and ensure web filtering solutions flag any future resolution to 34.144.206.118. Continuous threat‑intel feeds should be consulted for emerging indicators related to Ledger impersonation, and security teams should educate end users about unsolicited communications that reference Ledger services, urging verification through official channels before any credential submission.