desktop-startso[.]wixstudio[.]com

The domain desktop-startso.wixstudio.com was identified as a brand impersonation site targeting Ledger users. Infrastructure analysis shows the domain resolves to IP address 34.144.206.118, which is hosted by Google LLC (ASN 396982) in the United States. The authoritative name servers are dns1.p08.nsone.net through dns4.p08.nsone.net, indicating the use of NSONE's DNS service. The site employed a Let’s Encrypt R13 certificate, confirming that TLS was active at the time of observation, but the HTTP response returned a 404 status, suggesting the malicious page is no longer publicly reachable.

The page title captured during the scan, "Ledger® Live: Desktop® — Getting Started | official Ledger™", directly references Ledger's official product, reinforcing the impersonation intent. The domain registration was processed through Wix Studio, with the creation date recorded as 17 December 2016, showing the infrastructure has been in place for several years. Detection telemetry indicates that four of ninety‑one VirusTotal scanners flagged the domain, and it appears on a single external blocklist, where PhishDestroy has already listed it as malicious. Current status is offline, and the domain has been removed from active hosting, yet the historical artifacts remain relevant for threat hunting.

Defenders should continue to monitor for any resurgence of the domain or related subdomains, especially within the Wix Studio hosting environment, and ensure that endpoint and email security solutions reference the observed indicators of compromise, including the exact IP address, SSL fingerprint, and the specific page title string. Correlation of network traffic to 34.144.206.118 or DNS queries for desktop-startso.wixstudio.com should be treated as suspicious and blocked where possible.