en-ledzerlive[.]wixstudio[.]com

This domain, en-ledzerlive.wixstudio.com, poses a high-risk brand impersonation threat specifically targeting users of Ledger, a cryptocurrency hardware wallet provider. The site mimics the official Ledger Live login interface, presenting a fraudulent portal titled 'Ledger® Live: Login®® | Your Wallet®®' designed to harvest credentials or facilitate unauthorized transactions. Analysis indicates the domain was structured to deceive victims into entering sensitive wallet access details, potentially leading to direct financial theft or compromise of cryptocurrency assets. The use of official branding elements, including trademarks and login workflows, increases the likelihood of successful social engineering attacks against Ledger users. Evidence confirms the domain was flagged by 10 out of 95 security vendors on VirusTotal, indicating moderate detection but persistent risk. It was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on infrastructure leveraging Wix, React, Google Cloud, and HTTP/3 technologies. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and was secured with a Let's Encrypt SSL certificate, which while providing encryption, does not validate legitimacy. The site has since been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Users who visited en-ledzerlive.wixstudio.com or entered credentials on the site should immediately revoke access to any associated Ledger or cryptocurrency accounts. It is recommended to reset passwords, enable multi-factor authentication, and review transaction histories for unauthorized activity. Any devices used to access the site should be scanned for malware, as credential-stealing payloads may have been deployed. Cryptocurrency wallet recovery phrases or private keys entered on the site should be considered compromised, and funds should be transferred to new, secure wallets. Organizations maintaining blocklists or security feeds should ensure this domain and its associated IP are included in denylists to prevent future access attempts.