starts-ledgarcdn[.]wixstudio[.]com

PhishDestroy identifies starts-ledgarcdn.wixstudio.com as an active crypto drainer impersonating Ledger hardware wallets, currently assigned a Risk Level of under_investigation after initial triage. The threat actor leverages a compromised WixStudio subdomain to deliver a malicious JavaScript payload designed to drain cryptocurrency from connected wallets upon user interaction. This is not a generic phishing attempt but a targeted crypto asset theft campaign using a realistic fake login flow disguised as a Ledger Live interface.

This domain exhibits multiple red flags across threat intelligence platforms. VirusTotal reports 4 out of 95 detection engines flagged the page as malicious at time of analysis, indicating low signature coverage and high evasion potential. The domain resolves to IP 34.144.206.118, a Google Cloud Platform (GCP) address commonly used for dynamic hosting of short-lived attack infrastructure. The SSL certificate is issued by Let’s Encrypt, which is frequently abused due to its automated issuance process. While the specific creation date of starts-ledgarcdn.wixstudio.com is not publicly disclosed through standard WHOIS queries due to Wix’s privacy protection, the subdomain structure suggests recent deployment as part of a fast-moving campaign. No current listings were found on major blocklists such as Google Safe Browsing, PhishTank, or OpenPhish, reinforcing the novelty and stealth of this threat. The domain’s low age, clean hosting environment, and lack of prior abuse reports make it particularly dangerous to unsuspecting users.

To mitigate exposure to this crypto drainer, users must avoid clicking links from unsolicited emails, social media messages, or advertisements claiming to offer Ledger support or firmware updates. Always access Ledger services directly via the official ledger.com domain or the verified Ledger Live application. Use browser extensions like PhishDestroy to perform real-time domain reputation checks before entering credentials or connecting wallets. Enable hardware wallet confirmation prompts and double-check URLs for typos or subdomain anomalies such as 'ledgar' instead of 'ledger'. Report any interactions with this domain immediately to your wallet provider and PhishDestroy for further analysis. Given the absence of AV detections and the targeted nature of the campaign, proactive behavioral controls and hardware-based verification remain the most effective defenses against this evolving threat.