en-ledgelive[.]wixstudio[.]com

Domain en-ledgelive.wixstudio.com has been confirmed as an active phishing site impersonating the Ledger hardware wallet ecosystem. The domain mimics legitimate Ledger services to deceive users into entering recovery phrases or private keys. Threat actors are leveraging the WixStudio platform to host a spoofed interface, likely distributed via phishing emails or malicious ads. No specific drainer kit has been identified in the forensic analysis, but the site structure suggests a standard credential-stealing or crypto-wallet draining setup targeting Ledger users.

The domain resolves to IP 34.144.206.118 and is secured with a Let's Encrypt SSL certificate, increasing its perceived legitimacy. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, indicating evasion of traditional antivirus signatures. The registrar is Wix.com, and the domain was created recently, though the exact creation date is not provided in the available data. Google Safe Browsing (GSB) has not yet flagged the domain, and public blocklist data shows no prior listings. These factors suggest a newly deployed campaign with minimal historical detection.

This domain remains active and poses a high risk to Ledger users and cryptocurrency holders. Immediate actions include blocking the domain at the network and DNS levels, updating browser blacklists, and notifying Ledger’s abuse team for takedown. Users should avoid interacting with any links or emails referencing ledger-live or similar variations. Remaining risk is elevated due to the domain’s use of a reputable hosting platform and SSL certificate, which may bypass some security controls. Continuous monitoring for new IOCs and proactive user education are critical to mitigating further compromise.