starts-lexdger[.]wixstudio[.]com

PhishDestroy identifies starts-lexdger.wixstudio.com as an active phishing domain impersonating Ledger hardware wallets, leveraging a fraudulent drainer kit to siphon cryptocurrency assets. The threat actor abuses WixStudio’s subdomain hosting to deploy a convincing replica of Ledger’s official wallet interface, tricking users into entering seed phrases or private keys under the guise of account verification or firmware updates. Analysis of the drainer code reveals obfuscated JavaScript designed to intercept clipboard data, manipulate transaction details, and redirect funds to attacker-controlled wallets. This campaign mirrors recent trends in crypto-phishing, where threat actors exploit reputable hosting platforms to bypass traditional email-based detection mechanisms.

Technical indicators confirm this domain’s malicious intent: VirusTotal shows 0/95 security vendors flagged the URL as of the latest scan, indicating evasion of mainstream detection engines. The domain resolves to IP 34.144.206.118 via a Let’s Encrypt SSL certificate, suggesting the threat actor prioritizes HTTPS to enhance legitimacy. Registration details reveal the subdomain is hosted on WixStudio, a legitimate web hosting service, while the top-level domain remains unconfirmed. Google Safe Browsing (GSB) has not yet blacklisted the domain, and public blocklists (e.g., PhishTank, OpenPhish) show zero prior submissions. The absence of detections underscores the sophistication of this campaign, which relies on platform trust and user urgency to succeed.

The domain remains active as of the latest assessment, with no mitigation by hosting providers or security vendors. PhishDestroy recommends immediate blocking of starts-lexdger.wixstudio.com at the network and endpoint levels, alongside user education on verifying wallet URLs via Ledger’s official channels. While the immediate risk is high for users who interact with the site, the lack of widespread detection suggests broader exposure is likely. Proactive threat hunting for similar WixStudio-hosted drainers is advised, particularly given the domain’s recent activity and the drainer kit’s modular design. Users should treat any unsolicited wallet-related communications with extreme caution and verify sender domains independently.