live-usnew[.]wixstudio[.]com

This domain live-usnew.wixstudio.com was observed hosting a brand-impersonation page targeting Ledger. The site returned an HTTP 404 status and displayed the page title "404 Error: Page Not Found | Wix Studio". Technical fingerprinting shows the site is built on Wix and React, delivered through Google Cloud and Google Cloud CDN with HTTP/3 enabled. The underlying server is identified by the IP address 34.144.206.118, which belongs to Google Cloud in the United States. DNS resolution uses four NSOne nameservers (dns1.p08.nsone.net through dns4.p08.nsone.net).

The SSL certificate is issued by Let’s Encrypt (YR1), confirming the use of a free, domain-validated certificate. Registration data indicates the domain was registered through GoDaddy.com, LLC. The domain appears on a single security blocklist, PhishDestroy, and has been blocked by that provider. VirusTotal scanned the site with 95 AV engines and recorded no detections, though the absence of detections does not guarantee benign intent. The current operational status is offline, and the risk level remains under investigation.

Defenders should continue to treat the domain as malicious, add it to network and email filtering rules, and monitor for any re-activation or similar domains that use the same Wix hosting pattern. Because the infrastructure relies on shared cloud services, other domains hosted on the same IP or CDN may be leveraged in future campaigns; threat hunters should consider correlating activity on 34.144.206.118 and the NSOne name servers. Ongoing observation of GoDaddy-registered Wix domains that reference Ledger or other cryptocurrency brands is recommended to catch early-stage impersonation attempts. The combination of brand impersonation, use of a free SSL certificate, and presence on a known phishing blocklist provides sufficient evidence for immediate defensive action.