pagedesktop-us[.]wixstudio[.]com

This domain, pagedesktop-us.wixstudio.com, presents a high-risk brand impersonation threat targeting users of Ledger cryptocurrency hardware wallets. Analysis of the page content reveals a fraudulent replica of the official Ledger Live desktop application interface, specifically mimicking the "Getting Started" onboarding process. The domain was designed to harvest sensitive credentials, including wallet recovery phrases, private keys, and account login details under the guise of an official Ledger setup guide. Such attacks typically aim to gain unauthorized access to cryptocurrency assets by exploiting user trust in the targeted brand's authentication workflows. Evidence supporting this assessment includes multiple technical indicators. The domain is flagged by 15 out of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. Infrastructure analysis reveals it was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The domain appears on three security blocklists, including PhishDestroy and PhishingArmy, and was previously blocked by OISD. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. Technologies detected include Wix, React, and Google Cloud CDN, suggesting a professionally constructed facade designed to evade casual detection. Users who visited pagedesktop-us.wixstudio.com should immediately consider any credentials or sensitive information entered on the site as compromised. The first action is to revoke access to any Ledger or cryptocurrency accounts associated with the site, followed by generating new recovery phrases and private keys for all affected wallets. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. If cryptocurrency assets were accessed or transferred through the site, report the incident to relevant blockchain analysis services to trace and potentially freeze stolen funds. Given the high-risk nature of this threat, affected users should also scan their devices for malware, as phishing sites often deploy additional payloads to maintain persistence or exfiltrate data.