apps-ledgrcdn[.]wixstudio[.]com

This domain, apps-ledgrcdn.wixstudio.com, has been confirmed as a brand impersonation site specifically targeting Ledger, a cryptocurrency hardware wallet provider. The site mimics the official Ledger Live login interface to facilitate credential theft, posing a high risk to users who may unknowingly disclose sensitive wallet access information. As of the latest verification, the domain has been taken offline, but prior activity remains a significant concern for potential victims. Analysis indicates the domain was flagged by 16 of 95 security vendors on VirusTotal, signaling widespread detection of malicious intent. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on June 11, 2026, and resolved to the IP address 34.144.206.118. The site employed technologies including Wix, React, Google Cloud, Lodash, HSTS, and Google Cloud CDN, alongside HTTP/3 for data transmission. The SSL certificate was issued by Let's Encrypt, a common but not inherently trustworthy certificate authority in phishing campaigns. The domain appeared on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, further corroborating its malicious classification. Current status confirms the domain is offline, reducing immediate risk to users. However, the infrastructure and tactics observed suggest potential for resurgence or replication under a different domain. Organizations and individuals are advised to block the domain and associated IP address (34.144.206.118) at the network level. Users who may have interacted with this site should immediately revoke any credentials entered, enable multi-factor authentication on all cryptocurrency-related accounts, and monitor for unauthorized transactions. Security teams should review logs for connections to the domain or IP and conduct awareness training to highlight the risks of brand impersonation in the cryptocurrency space.