desktop-applives[.]wixstudio[.]com

The domain desktop-applives.wixstudio.com has been identified as a high-risk brand impersonation threat targeting Ledger, a well-known cryptocurrency hardware wallet provider. Analysis confirms the domain was designed to mimic the official Ledger Live Desktop application, as evidenced by the page title 'Ledger Live Desktop® — Getting Started | Official Ledger.' Currently, the domain is offline, but prior activity indicates malicious intent to deceive users into downloading counterfeit software. Infrastructure analysis reveals the domain resolved to the IP address 34.144.206.118 and was flagged by 12 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The domain was registered through GoDaddy.com, LLC and employed a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy. Technologies detected include Wix, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3, suggesting an attempt to leverage modern web infrastructure to evade detection. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, further corroborating its malicious classification. Given the domain's current offline status, immediate threats to users are mitigated; however, the infrastructure and tactics observed warrant continued vigilance. Organizations and individuals should block the domain and its associated IP address (34.144.206.118) at the network level to prevent potential re-emergence. Users are advised to verify the authenticity of Ledger-related downloads exclusively through the official Ledger website or trusted distribution channels. Monitoring for similar impersonation domains, particularly those hosted on Wix or leveraging Google Cloud infrastructure, is recommended to preempt future threats.