ledgarlive[.]wixstudio[.]com

Analysis of the domain ledgarlive.wixstudio.com indicates it was actively impersonating Ledger, a hardware cryptocurrency wallet provider, as part of a credential phishing campaign. The domain, hosted on Wix Studio's infrastructure, presented itself with the page title 'Ledger Live Login™ – Safe Wallet Access®,' directly mimicking Ledger's official login portal. As of July 24, 2026, the domain has been taken offline, returning an HTTP 404 status, though infrastructure analysis reveals it previously resolved to 34.144.206.118, an IP address assigned to Google LLC (AS396982) in the United States. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains due to its free and automated issuance process.

The domain was registered through GoDaddy.com, LLC on December 17, 2016, though this long registration period does not inherently indicate legitimacy, as older domains are frequently repurposed for malicious activity. Nameservers are hosted by NS1 (dns1.p08.nsone.net through dns4.p08.nsone.net), a provider used by both legitimate and fraudulent sites. Detection data shows the domain appeared on one security blocklist, and three of 91 security vendors on VirusTotal flagged it as malicious, suggesting moderate but not universal detection at the time of scanning. While the domain is now offline, its infrastructure remains a potential vector for future abuse.

Defenders should monitor for re-emergence under the same or similar domains, particularly those leveraging Wix Studio or Google Cloud IP ranges. Organizations using Ledger products should alert users to verify domain authenticity before entering credentials and consider implementing additional authentication measures for wallet access. The absence of widespread blocklist coverage highlights the need for proactive monitoring of newly registered or repurposed domains impersonating cryptocurrency services.