strt-ledgr-en[.]weebly[.]com

PhishDestroy identifies a live Ledger credential harvesting domain, strt-ledgr-en.weebly.com, masquerading as a legitimate Ledger login portal. The infrastructure leverages a Weebly-hosted subdomain to impersonate the popular hardware wallet brand, aiming to dupe users into surrendering their recovery phrases or private keys. No evidence of a custom drainer kit has been observed at this stage, suggesting reliance on a standard phishing template cloned from Ledger’s official authentication flow. This domain resolves to the IPv4 address 74.115.51.8 and is registered through MarkMonitor Inc., a provider often abused for bulk domain squatting operations. The domain was originally created on March 29, 2006, predating the current Ledger campaign, and currently holds a valid SSL certificate issued by Let’s Encrypt. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, and the site remains unflagged by Google Safe Browsing and major threat intelligence blocklists. While the risk level is marked as ‘under_investigation,’ the domain remains active and poses an immediate threat to cryptocurrency users. Organizations are advised to block the domain at the DNS and network levels and to warn users about impersonation attempts involving Ledger-branded domains. Remaining risk includes continued availability of the page and potential evolution into a more sophisticated drainer deployment. Immediate takedown requests via hosting provider abuse channels are recommended to mitigate ongoing exposure.