desktop-livescdm[.]wixstudio[.]com

This domain, desktop-livescdm.wixstudio.com, is identified as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The domain specifically mimics Ledger Live, the official desktop software for managing Ledger devices, as evidenced by the page title 'Ledger Live®® Desktop — Getting Started | Official Ledger Wallet.' The domain is currently offline, but prior analysis indicates it was actively used for malicious purposes. Analysis of the domain reveals it was flagged by 14 of 95 security vendors on VirusTotal, a significant indicator of malicious activity. The domain was registered through GoDaddy.com, LLC, and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. It appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, further confirming its malicious nature. The SSL certificate was issued by Let’s Encrypt, a common choice for both legitimate and fraudulent sites. Technologies detected include Wix, React, Google Cloud CDN, and HTTP/3, which are consistent with modern web infrastructure but do not mitigate the threat posed. Given the domain’s current offline status, immediate risk to users is reduced. However, organizations and individuals should remain vigilant for similar threats. Recommended actions include blocking the domain and its associated IP address (34.144.206.118) at the network level, monitoring for any re-emergence of the domain or related infrastructure, and educating users about the risks of brand impersonation attacks targeting cryptocurrency wallets. Users should verify the authenticity of any software downloads by accessing official sources directly and avoiding links from untrusted channels.