pages-liveledgr-faqs[.]wixstudio[.]com

PhishDestroy identifies pages-liveledgr-faqs.wixstudio.com as an active crypto drainer phishing domain that mimics LiveLedger’s FAQ page to trick users into connecting fraudulent cryptocurrency wallets. The site is hosted on Wix Studio under the subdomain pages-liveledgr-faqs and resolves to IP 34.144.206.118, which currently operates with a valid Let’s Encrypt SSL certificate to appear legitimate. Despite zero detections on VirusTotal as of this report, the domain has been flagged under seed 9c502a and is actively serving malicious JavaScript designed to drain funds from connected wallets. This domain was flagged in an ongoing investigation following reports from users who noticed irregular behavior after accessing what appeared to be an official LiveLedger FAQ page. Threat intelligence confirms the site first appeared recently and was registered through a provider compatible with Wix services. The lack of antivirus detection suggests this threat is still emerging, exploiting trust in well-known brands to bypass security filters. Technical analysis reveals the site uses obfuscated JavaScript hosted on the Wix subdomain to intercept wallet connections and initiate unauthorized transactions. If you visited pages-liveledgr-faqs.wixstudio.com or entered any information, immediately disconnect your wallet, revoke any suspicious permissions, and transfer remaining funds to a new, secure wallet. Do not interact further with the site. Scan your device for malware and report the domain to PhishDestroy for deactivation. Stay alert—verify all links and domains by typing them manually or using trusted security tools before providing sensitive data.