livelogen[.]wixstudio[.]com

This domain, livelogen.wixstudio.com, is a confirmed phishing site designed to impersonate Ledger, a cryptocurrency hardware wallet provider. The site specifically targets users seeking to download Ledger Live Desktop, a legitimate crypto portfolio management application, by presenting a fraudulent download page titled 'Ledger Live Desktop© Crypto Portfolio Manager ® Download.' The objective is to deceive victims into downloading malicious software or divulging sensitive credentials, potentially leading to unauthorized access to cryptocurrency wallets and financial theft. Analysis indicates the domain is hosted on infrastructure associated with a widely used website builder platform and resolves to the IP address 34.144.206.118, part of a major cloud provider's network. The domain is flagged by 14 out of 95 security vendors on VirusTotal, and it appears on three independent security blocklists, including PhishDestroy and PhishingArmy. The SSL certificate is issued by Let's Encrypt, a common practice among both legitimate and malicious sites to evade browser warnings. The domain was registered through a large domain registrar and leverages technologies such as React, Google Cloud, and HTTP/3, which are consistent with modern web applications but do not inherently indicate legitimacy. Users who visited livelogen.wixstudio.com or downloaded files from it should assume compromise. Immediate steps include disconnecting the affected device from the internet, scanning for malware using updated security tools, and revoking any active sessions or credentials associated with cryptocurrency wallets. If Ledger Live or any other software was installed from this domain, it should be removed, and a clean installation should be obtained only from the official Ledger website. Wallet recovery phrases or private keys should never be entered on untrusted sites. Affected users are advised to monitor their cryptocurrency transactions for unauthorized activity and consider migrating assets to a new wallet if compromise is suspected.