startd-nowlive[.]wixstudio[.]com

This domain, startd-nowlive.wixstudio.com, is flagged for brand_impersonation targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the fraudulent page mimics the official Ledger Live login interface, with a page title of 'Ledger® Live: Login®® | Your Wallet®,' designed to deceive users into entering sensitive credentials. The domain leverages infrastructure associated with a known website builder platform, suggesting an attempt to exploit its legitimate reputation for malicious purposes. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, hosted on a content delivery network utilizing Google Cloud and Google Cloud CDN. The SSL certificate is issued by Let's Encrypt, a common practice among both legitimate and malicious sites. Detection metrics show the domain is flagged by 3 out of 95 security vendors on VirusTotal, with additional listings on PhishDestroy, PhishingArmy, and OISD blocklists. No Google Safe Browsing (GSB) status is provided, but the presence on multiple blocklists underscores its malicious classification. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure remains a residual risk, as threat actors may repurpose similar domains or IPs for future campaigns. Users who interacted with the domain prior to its takedown should assume credential compromise and initiate remediation protocols, including password resets and multi-factor authentication reviews. Organizations are advised to monitor for related indicators of compromise, such as the IP 34.144.206.118, and update blocklists to prevent recurrence.