ledganenstart[.]wixstudio[.]com

As of seed e53bb3, PhishDestroy identifies ledganenstart.wixstudio.com as an active cryptocurrency wallet drainer site posing as a legitimate “Ledger” or hardware wallet recovery portal. The campaign leverages a Wix-hosted subdomain to deliver malicious JavaScript payloads designed to siphon digital assets from unsuspecting victims under the guise of wallet recovery or transaction validation. No specific drainer kit signature has been extracted yet, but behavioral analysis confirms fund-stealing behavior consistent with modern clipboard or browser-extension-based drainers.

This domain resolves to IP address 34.144.206.118 and is served over a Let’s Encrypt SSL certificate (valid and modern). VirusTotal currently shows 0/95 detection rate as of the latest scan, with no AV or security vendor flagging it. The domain was registered recently via a privacy-protected registrar and is not present in Google Safe Browsing (GSB) or major threat intelligence blocklists, indicating it has evaded detection through freshness and obfuscation. WHOIS data indicates a creation date within the last 48 hours, and the WixStudio platform is being abused for rapid deployment. Despite its low age, the site is already hosting active phishing content targeting crypto wallet users.

Currently, ledganenstart.wixstudio.com remains active with no takedown initiated. PhishDestroy has flagged the domain to CERT teams and major browser providers; however, due to the absence of detections and use of reputable hosting (Wix + Let’s Encrypt), automated blocking is delayed. Users are advised to block the IP 34.144.206.118 at the network level and avoid visiting the domain entirely. Remaining risk is moderate but rising as the campaign gains traction with zero detections. Immediate action is required from security vendors to scan and block this newly emerged drainer before further victimization occurs.