guard-desktop[.]wixstudio[.]com

The domain guard-desktop.wixstudio.com poses a high risk of brand impersonation, specifically targeting Ledger users. This domain was designed to deceive individuals into believing they were interacting with an official Ledger Live®® Desktop page, potentially leading to the theft of personal and financial information.

Analysis indicates that guard-desktop.wixstudio.com was flagged by 11 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion. The domain was registered through GoDaddy.com, LLC, and resolved to the IP address 34.144.206.118. It utilized technologies such as Wix, Envoy, React, Google Cloud, and Google Cloud CDN, and supported HTTP/3. The page title, 'Ledger Live®® Desktop — Getting Started | Official Ledger Wallet,' further reinforces the impersonation. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and has a trust score that reflects its malicious intent. Although the domain is currently offline, its past activity and technical infrastructure indicate a deliberate attempt to deceive Ledger users.

To mitigate the risks associated with this brand impersonation threat, users are advised to verify the URL of any Ledger-related websites they visit. Official Ledger pages can be accessed directly through Ledger’s official website or verified through trusted sources. Additionally, users should enable multi-factor authentication (MFA) on their Ledger accounts and regularly monitor their account activity for any unauthorized access. Security teams are encouraged to monitor and block any related domains and IP addresses to prevent further phishing attempts.