startapp-legir[.]wixstudio[.]com

This domain, startapp-legir.wixstudio.com, is identified as a high-risk brand impersonation threat specifically targeting Ledger, a hardware cryptocurrency wallet provider. The site is currently offline but was actively impersonating the official Ledger setup portal, as evidenced by its page title 'Ledger.com/Start® | Getting Start™,' designed to deceive users into initiating wallet configuration processes on fraudulent infrastructure. Analysis indicates the domain was created on June 11, 2026, and registered through GoDaddy.com, LLC. It resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure with technologies including Wix, React, and Google Cloud CDN. The domain appears on three security blocklists—PhishDestroy, PhishingArmy, and OISD—and is flagged by 14 of 95 security vendors on VirusTotal. The SSL certificate was issued by Let's Encrypt, and the site employed HSTS and HTTP/3 protocols, likely to enhance perceived legitimacy. The domain has since been taken offline, but its infrastructure and historical activity pose residual risks. Organizations and users are advised to block the domain and IP address at the network level, update endpoint protection rules to include this indicator, and monitor for any re-emergence of similar subdomains under wixstudio.com or other Wix-hosted platforms. Users who may have interacted with this domain should verify their Ledger device integrity and revoke any suspicious wallet authorizations.