ledgstart-eng[.]wixstudio[.]com

This domain, ledgstart-eng.wixstudio.com, is flagged as a generic phishing site targeting cryptocurrency users through brand impersonation. The page mimics the official Ledger.com/Start onboarding portal, using the title 'Official | Lédger.com/Start® | Getting Started® - Started®' to deceive victims into entering recovery phrases or private keys. No specific drainer kit signatures were identified, but the site aligns with common crypto wallet phishing tactics, including fake login interfaces and urgency-driven prompts. The domain does not exhibit overt crypto drainer behavior but serves as a credential harvester for subsequent wallet compromise. Analysis indicates the domain was registered on June 11, 2026, through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. VirusTotal detection shows 14 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. SSL certification is provided by Let's Encrypt, and technologies detected include Wix, React, Google Cloud CDN, and HTTP/3. No Google Safe Browsing (GSB) listing was confirmed at the time of analysis. The domain is currently offline, likely due to hosting or registrar enforcement actions. However, the infrastructure remains a residual risk, as threat actors may re-deploy the phishing kit under a new subdomain or domain. Users who interacted with the site should assume credential exposure and take immediate action, including revoking wallet access, rotating recovery phrases, and monitoring for unauthorized transactions. Organizations are advised to block the domain, IP, and associated SSL certificate fingerprints in network security controls to prevent future access attempts.