nav-ledgorsso[.]wixstudio[.]com

This domain, nav-ledgorsso.wixstudio.com, is flagged for brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site mimics the official Ledger Live desktop application, presenting a page titled "Ledger® Live: Desktop® — Getting Started™" to deceive users into downloading malicious software or disclosing sensitive credentials. The threat type is classified as brand impersonation with an elevated risk level, suggesting a deliberate attempt to exploit trust in the Ledger brand for fraudulent purposes. No direct evidence of a drainer kit was observed, but the infrastructure aligns with common phishing tactics used in cryptocurrency-related scams.

Infrastructure analysis reveals the domain resolves to the IP address 34.144.206.118, hosted on a platform utilizing Google Cloud and Google Cloud CDN. The domain is registered through a widely used registrar, though no exact creation date is provided in the available data. Security vendors on VirusTotal flagged the domain with a score of 12/95, indicating moderate detection but sufficient concern for blocking. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. Technologies detected include Wix, React, and HTTP/3, with a Let's Encrypt SSL certificate providing encryption, a common tactic to lend legitimacy to fraudulent sites.

As of the latest assessment, nav-ledgorsso.wixstudio.com has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure remains a residual risk, as threat actors may repurpose the domain or migrate to similar domains using the same hosting and registration patterns. Users who interacted with the site should assume credential exposure and take immediate action, including revoking access to any associated cryptocurrency wallets and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. Vigilance is advised, as similar impersonation campaigns may emerge targeting Ledger or other cryptocurrency brands.