starterhomeledger[.]com

PhishDestroy analysts identified starterhomeledger.com as a domain actively impersonating the Ledger brand, currently under investigation for brand impersonation tactics. This domain exhibits classic hallmarks of a cryptocurrency drainer kit, with UI elements and functionality designed to deceive users into connecting their wallets under false pretenses. The threat actor leverages stolen branding to establish credibility and facilitate unauthorized fund transfers. This domain was flagged with a VirusTotal detection ratio of 1 out of 95 engines as of the latest scan, indicating a low initial detection rate despite its malicious intent. Registered through NAMECHEAP INC on March 23, 2026, the domain resolves to IP address 185.199.109.153 and holds a valid SSL certificate issued by Let's Encrypt. The domain remains unflagged by Google Safe Browsing and has not been listed on major threat blocklists at this time. Current status of this domain is marked as 'active' with a risk level categorized as 'under_investigation'. Immediate response actions include continued monitoring for changes in infrastructure or behavior, as well as collaboration with hosting providers and registrars to mitigate further abuse. The remaining risk is considered elevated due to the domain's recent registration, lack of blocklist coverage, and the high potential for user deception given the targeted brand. Users are strongly advised to avoid interacting with this domain and report any suspicious activity to their security teams.