endesktop-ledgrs[.]wixstudio[.]com

This domain, endesktop-ledgrs.wixstudio.com, is flagged as a brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the domain was designed to mimic the legitimate Ledger Live Desktop application, as evidenced by the page title "Ledger Live Desktop® — Starting Up Your Device | Ledger®®." The threat type aligns with brand impersonation tactics, likely intended to deceive users into downloading malicious software or entering sensitive credentials under the guise of a trusted crypto management tool. No explicit drainer kit signatures were identified, but the domain’s structure and content suggest a focus on credential harvesting or malware distribution. Technical indicators confirm elevated risk. The domain resolves to IP address 34.144.206.118 and was registered through GoDaddy.com, LLC. It is associated with a Let’s Encrypt SSL certificate, which, while common for legitimate sites, is frequently abused in phishing campaigns. VirusTotal detection shows 12 out of 95 security vendors flagging the domain as malicious. Infrastructure analysis reveals the use of Wix, Envoy, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3 support. The domain appears on one security blocklist, and no Google Safe Browsing (GSB) flags were reported at the time of analysis. No creation date was provided, but the combination of hosting technologies and SSL certificate suggests recent deployment. The domain is currently offline, mitigating immediate risk to users. However, the infrastructure remains intact, and the domain could be reactivated or repurposed. Response actions included takedown or suspension, likely initiated by the hosting provider or security entities. Remaining risks include potential reuse of the domain or migration of the phishing kit to a new domain with similar naming conventions. Users are advised to verify the authenticity of Ledger-related communications by accessing the official website directly and avoiding links or downloads from third-party sources. Organizations should monitor for similar domain registrations using the "endesktop" or "ledgrs" naming patterns and update blocklists accordingly.