us-live-desktop[.]wixstudio[.]com

This domain, us-live-desktop.wixstudio.com, presents a high-risk brand impersonation threat targeting users of Ledger cryptocurrency hardware wallets. The page mimics the official Ledger Live desktop application interface, using the exact title 'Ledger® Live: Desktop — Getting Started®' to deceive victims into entering sensitive wallet credentials or recovery phrases. Analysis indicates the infrastructure was designed to closely replicate legitimate wallet software distribution channels, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain is flagged by 13 out of 95 security vendors on VirusTotal, appears on three distinct security blocklists, and is currently blocked by PhishDestroy, PhishingArmy, and OISD. It resolves to IP address 34.144.206.118 within Google Cloud infrastructure and employs technologies including Wix hosting platform, React framework, and Google Cloud CDN with HTTP/3 support. The domain was registered through GoDaddy.com, LLC and secured with a Let's Encrypt SSL certificate, creating a false appearance of legitimacy while maintaining operational anonymity. Users who visited this domain should immediately assume potential credential compromise. Affected parties must cease all interaction with the site, revoke any entered credentials or recovery phrases, and monitor connected cryptocurrency wallets for unauthorized transactions. Cryptocurrency holders should verify software downloads exclusively through official vendor channels and implement hardware-based two-factor authentication for wallet access. The domain's current offline status does not eliminate risk, as compromised credentials may remain valid for future exploitation. Organizations should update security blocklists to include this domain and associated IP address 34.144.206.118 to prevent future access attempts.