ledgrliiv-desktop[.]wixstudio[.]com

PhishDestroy identifies ledgrliiv-desktop.wixstudio.com as a live crypto-draining phishing portal actively harvesting funds from unsuspecting users. The site masquerades as a legitimate Ledger wallet dashboard, tricking visitors into connecting their hardware wallets and signing malicious transactions that drain assets directly to attacker-controlled addresses. Unlike generic phishing pages that merely harvest credentials, this domain executes on-chain theft by exploiting wallet-connect approvals, turning a single click into an irreversible financial loss. Technical indicators show the domain resolves to IP 34.144.206.118, currently served via a Let’s Encrypt SSL certificate to appear trustworthy, but remains undetected by all 95 VirusTotal engines, highlighting its novel evasion tactics. The domain was registered recently and operates under Wix’s free-tier hosting (ledgrliiv-desktop.wixstudio.com), making takedown more difficult due to rapid domain cycling and shared infrastructure. Historical WHOIS data indicates the site was created within the last 30 days, a common tactic for campaigns that spin up hundreds of short-lived domains per week. Despite zero detections, PhishDestroy’s behavioral analysis flags it for crypto drainer signatures, including clipboard manipulation and wallet-connect lure scripts. Current blocklist coverage remains at 0 public lists, reinforcing the urgency to act before this domain spreads further through social engineering vectors such as fake support chats or impersonated airdrop links. If you visited ledgrliiv-desktop.wixstudio.com, disconnect your wallet immediately, revoke any wallet-connect sessions in your wallet settings, and scan your device for malware using a reputable antivirus suite. Never interact with wallet connection prompts or transaction signing dialogs triggered by this site. Consider transferring remaining funds to a clean, air-gapped wallet and report the domain to your wallet provider and PhishDestroy for further analysis. Block this domain at DNS and browser levels to prevent accidental re-entry, and warn others in your network who may have encountered similar Ledger impersonation lures.