m--start-y-edger-oauth[.]webflow[.]io

PhishDestroy identifies m--start-y-edger-oauth.webflow.io as a confirmed brand impersonation phishing site targeting Ledger users. The domain, registered through Webflow, was designed to mimic the legitimate Ledger Start page, as evidenced by its page title "Official Site® | Ledger.com/Start® - Getting started." This phishing campaign likely aims to steal cryptocurrency wallet credentials or seed phrases from unsuspecting victims.

Technical indicators paint a clear picture of malicious intent. VirusTotal analysis shows 16 out of 95 security vendors flagging this domain as malicious. The domain resolves to IP address 172.64.151.8 and uses an SSL certificate issued by Google Trust Services (WE1). It appears on one security blocklist, indicating limited but confirmed recognition of its threat. The domain's status is currently offline, suggesting it has been taken down or is inactive.

As of the latest intelligence, the domain has been taken offline, mitigating immediate risk. However, users should remain vigilant as similar phishing campaigns targeting Ledger customers are common. PhishDestroy recommends always verifying URLs before entering sensitive information, enabling two-factor authentication, and using hardware wallets with official software. If you encounter this domain, do not interact with it and report it to relevant authorities. Check the full report for additional indicators and safety guidance.