ledgstart[.]wixstudio[.]com

PhishDestroy identifies ledgstart.wixstudio.com as a live phishing domain under active investigation for impersonating Ledger cryptocurrency services. This WixStudio subdomain leverages a deceptive path to harvest login credentials and may distribute malware payloads to visitors. The campaign is currently classified as a generic phishing threat with an under-investigation risk rating, indicating potential escalation as additional IOCs are gathered. Users are advised to treat this domain with extreme caution and refrain from interacting with its content. This domain resolves to IP address 34.144.206.118 and utilizes a Let’s Encrypt SSL certificate for TLS encryption. Notably, VirusTotal analysis returned zero detections across 95 vendor engines, suggesting minimal prior exposure or signature coverage. The infrastructure is hosted on Google Cloud (AS15169), which may facilitate rapid domain rotation and evasion of blocklists. No blocklist presence was detected during initial scans, and trust scores remain unvalidated due to the domain’s recent or ephemeral nature. The domain remains active and under continuous monitoring. Security teams and end users should immediately block ledgstart.wixstudio.com at the network and endpoint levels using DNS sinkholing or firewall rules. If exposure is suspected, force password resets for affected accounts, enable multi-factor authentication, and scan systems for unauthorized access. Report any observed activity to your threat intelligence platform using the unique seed identifier fd7452 for correlation with ongoing investigations.