live-ledgrs-apps[.]wixstudio[.]com

This domain is flagged as a confirmed credential harvesting site targeting cryptocurrency wallet users through brand impersonation. Analysis indicates the site specifically mimics Ledger, a hardware wallet provider, by presenting a fraudulent login portal titled 'Ledger® Live: Login | Secure Access to Your® Wallet®.' The threat type is categorized as brand_impersonation with an elevated risk level due to its direct targeting of sensitive financial credentials and cryptocurrency assets. Infrastructure analysis reveals the domain is hosted on a Wix Studio platform, resolving to the IP address 34.144.206.118, which is associated with Google Cloud infrastructure. The domain employs a Let's Encrypt SSL certificate, providing a false sense of security to potential victims. Detection metrics show 9 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The domain is registered through GoDaddy.com, LLC, though no specific creation date is available for this subdomain. It appears on three security blocklists: PhishDestroy, PhishingArmy, and OISD. Technologies detected include Wix, React, Google Cloud, Lodash, HSTS, Google Cloud CDN, and HTTP/3, suggesting a modern web stack designed to evade basic detection mechanisms. Mitigation against this specific threat type requires immediate action from both end-users and security teams. Users should verify domain authenticity by cross-referencing official Ledger communication channels before entering credentials. Security teams are advised to block the domain and its resolving IP (34.144.206.118) at the network perimeter. Given the domain's current offline status, monitoring for re-emergence under similar subdomains or IP ranges is critical. Cryptocurrency holders should enable multi-factor authentication on all wallet services and treat unsolicited login prompts as high-risk incidents. Organizations should update endpoint protection rules to flag domains using Wix Studio infrastructure that impersonate financial services, particularly those with Let's Encrypt certificates and Google Cloud hosting.