client-desktop[.]wixstudio[.]com

This domain, client-desktop.wixstudio.com, is identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The page title, "Ledger Live®® Desktop — Getting Started | Official Ledger Wallet," directly mimics Ledger’s legitimate software, likely aiming to deceive users into entering sensitive credentials or installing malicious software. No specific drainer kit signatures were observed in available telemetry, but the infrastructure aligns with common phishing tactics used to compromise crypto wallet access or distribute malware under the guise of official support resources. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolved to IP address 34.144.206.118. At the time of assessment, VirusTotal reported 5 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The SSL certificate was issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. No Google Safe Browsing (GSB) records were available for this domain at the time of analysis, though its presence on multiple blocklists suggests prior detection by other security mechanisms. The domain is currently offline, reducing immediate risk to users. However, the infrastructure may remain under the control of threat actors, who could repurpose it for future campaigns. The elevated risk level is justified by the domain’s prior use in brand impersonation, its presence on multiple blocklists, and the targeted nature of the attack against cryptocurrency users. Users who may have interacted with this domain should revoke any associated wallet permissions, reset credentials, and monitor accounts for unauthorized transactions. Security teams are advised to maintain blocklist entries for this domain and associated IP addresses to prevent potential reuse.