update-ledgrlive[.]wixstudio[.]com

This domain, update-ledgrlive.wixstudio.com, poses a credential theft risk by impersonating the Ledger cryptocurrency wallet interface. The site mimics the official Ledger Live login page, using the identical page title 'Ledger® Live: Login | Your Wallet®' to deceive users into entering sensitive account credentials. Infrastructure analysis reveals the domain was designed to harvest login details, likely for unauthorized access to cryptocurrency wallets or financial accounts. The threat primarily targets Ledger users, exploiting brand trust to facilitate fraudulent activity. Analysis indicates the domain is flagged by 14 out of 95 security vendors on VirusTotal, confirming its malicious classification. It was registered through GoDaddy.com, LLC, and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The site employed technologies including Wix, React, and Google Cloud CDN, with an SSL certificate issued by Let's Encrypt. It appeared on one security blocklist and was subsequently blocked by PhishDestroy before being taken offline. The combination of brand impersonation, low detection count, and cloud-based hosting suggests a targeted phishing campaign. Users who visited update-ledgrlive.wixstudio.com should assume their credentials may have been compromised. Immediately change passwords for any accounts accessed through the site, particularly Ledger or other cryptocurrency-related services. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor financial and cryptocurrency accounts for suspicious transactions, and report any unauthorized activity to the relevant platform. If sensitive information was entered, consider revoking active sessions and generating new wallet addresses as a precautionary measure. Avoid interacting with similar domains or unsolicited login prompts in the future.