official-liveledgr[.]wixstudio[.]com

PhishDestroy identifies official-liveledgr.wixstudio.com as a fraudulent clone of Ledger Live, designed to harvest cryptocurrency wallet credentials and seed phrases from unsuspecting users. This Wix-hosted domain leverages a legitimate-looking interface and a valid Let's Encrypt SSL certificate to appear trustworthy, while operating with malicious intent. The site is currently active and under active investigation, with no detections on VirusTotal (5/95 engines as of seed 08189f).

This domain poses a high-risk threat to cryptocurrency holders, particularly those using Ledger hardware wallets. The attackers exploit the trust associated with the Ledger brand to trick users into entering sensitive recovery phrases or private keys, which are then harvested for unauthorized fund transfers. The infrastructure is hosted on Google Cloud (IP: 34.144.206.118), a common tactic to evade traditional blocklists. While VirusTotal currently shows zero detections, this is not uncommon for newly launched phishing campaigns, which often fly under the radar for days or weeks. The domain's recent creation and lack of reputation make it a prime candidate for credential theft and financial fraud.

Users who visited this site should IMMEDIATELY assume their Ledger recovery phrase or private keys may have been compromised. Revoke all connected wallet permissions, transfer remaining funds to a new wallet with a fresh seed phrase, and consider purchasing a new Ledger device if credentials were entered. Enable two-factor authentication on all exchanges and wallets, and monitor for unauthorized transactions. Report the domain to your antivirus provider and local cybercrime units. Never reuse recovery phrases across multiple devices.