begin-legorlivee[.]wixstudio[.]com

This domain, begin-legorlivee.wixstudio.com, is flagged as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimicked the official Ledger Live login interface, using the page title "Ledger® Live: Login | Your Wallet®®" to deceive users into submitting credentials. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting tactics commonly used to facilitate subsequent unauthorized transactions. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118. Technologies detected include Wix as the hosting platform, alongside React, Google Cloud, and Google Cloud CDN. The SSL certificate was issued by Let's Encrypt, and the site supported HTTP/3. At the time of assessment, VirusTotal reported 10 out of 95 security vendors flagging the domain as malicious. The domain appeared on three security blocklists: PhishDestroy, PhishingArmy, and OISD. No Google Safe Browsing (GSB) status was recorded, and the domain's creation date remains unconfirmed in available telemetry. The domain has since been taken offline, likely due to enforcement actions from security vendors or hosting providers. However, residual risk persists, as threat actors may re-establish infrastructure using similar naming conventions or redirect victims to alternate domains. Users who interacted with the site are advised to revoke any active sessions, reset credentials, and monitor associated accounts for unauthorized activity. Organizations should update blocklists to include this domain and conduct retroactive scans for related indicators of compromise.