ledgrlive-ldg[.]wixstudio[.]com

This domain, ledgrlive-ldg.wixstudio.com, is hosted on Wix Studio infrastructure and exhibits multiple indicators consistent with a credential-harvesting phishing campaign targeting Ledger Live users. Analysis indicates the subdomain was created under the parent wixstudio.com domain on December 17, 2016, though recent malicious activity suggests either a compromise of an existing site or the activation of a dormant subdomain for phishing purposes. Nameservers resolve to dns1.p08.nsone.net through dns4.p08.nsone.net, a configuration commonly associated with legitimate Wix deployments but also observed in phishing sites leveraging the platform's free hosting. As of July 29, 2026, two of ninety-one security vendors on VirusTotal have flagged the domain as malicious, a detection ratio that, while low, aligns with early-stage phishing campaigns before widespread vendor coverage.

The domain appears on one security blocklist and is actively blocked by PhishDestroy, corroborating its classification as a phishing threat. No Safe Browsing or Open Threat Exchange records were provided in the available intelligence, limiting additional confirmation from those sources. Infrastructure analysis reveals no anomalous hosting patterns; the use of Wix Studio aligns with the domain's registration details and suggests the attacker is leveraging the platform's built-in tools to host the phishing content. The exact page content remains unanalyzed, but the domain naming convention—combining 'ledgrlive' with 'ldg'—strongly implies an intent to deceive users into believing they are interacting with the legitimate Ledger Live cryptocurrency wallet service.

Defenders should treat this domain as an active threat and prioritize blocking it at the DNS or proxy level. Organizations using Ledger Live should alert users to this campaign and reinforce phishing awareness, particularly for communications involving wallet access or recovery.