screen-desktoplive[.]wixstudio[.]com

This infrastructure is assessed as high risk due to brand impersonation targeting Ledger, presenting a counterfeit onboarding/login interface intended to harvest sensitive authentication data. The page mimics official “Ledger Live Desktop® — Getting Started | Official Ledger” branding to increase credibility and user trust exploitation.

Technical telemetry indicates resolution to IP 34.144.206.118 with hosting components leveraging Wix, React, Google Cloud, Google Cloud CDN and HTTP/3 transport. The TLS certificate is issued via Let's Encrypt. Domain registration is attributed to GoDaddy.com, LLC. Security telemetry shows VirusTotal detection ratio of 15/95 security vendors flagging the domain. The asset is additionally present on 3 security blocklists including PhishDestroy, PhishingArmy and OISD. Observed page title matches “Ledger Live Desktop® — Getting Started | Official Ledger”, indicating direct brand impersonation of Ledger. Current operational status is reported as offline, suggesting takedown or sinkholing following detection.

Mitigation requires immediate blocking of the domain and associated IP 34.144.206.118 at network perimeter controls, along with certificate-based and SNI filtering where applicable. Threat intelligence feeds should be updated to include indicators such as the GoDaddy.com, LLC registration record, Let's Encrypt certificate fingerprint, and the observed Wix/Google Cloud CDN infrastructure profile. Users should be warned that any request for wallet recovery phrases or onboarding credentials associated with Ledger branding outside verified official channels is malicious. Endpoint protections should enforce URL reputation scoring, and historical access logs should be reviewed for potential credential submission events. Given the 15/95 detection ratio and multi-list block presence, incident response teams should treat any interaction as potential compromise and initiate credential rotation procedures if exposure is suspected.