enusdesktop[.]wixstudio[.]com

This domain, enusdesktop.wixstudio.com, is identified as a high-risk phishing resource designed to impersonate Ledger, a cryptocurrency hardware wallet provider. The page mimics the official Ledger Live Desktop interface, displaying the title 'Ledger Live Desktop® — Starting Up Your Device | Ledger®®' to deceive users into believing they are interacting with legitimate software. The objective of this campaign appears to be credential harvesting or the distribution of malicious payloads under the guise of wallet initialization, exploiting trust in the Ledger brand to compromise sensitive financial data or cryptocurrency assets.

Analysis indicates that enusdesktop.wixstudio.com is flagged by 16 out of 95 security vendors on VirusTotal, a significant detection rate that underscores its malicious nature. The domain was registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. Infrastructure analysis reveals the use of Wix, React, and Google Cloud CDN, alongside HTTP/3 and HSTS protocols, which may be leveraged to lend an air of legitimacy to the phishing site. The domain was created on April 20, 2026, though this timestamp may reflect backdating or administrative manipulation. Currently, the domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and has been taken offline, though residual risks may persist.

Users who visited enusdesktop.wixstudio.com or interacted with its content are advised to take immediate remedial actions. Any credentials, recovery phrases, or private keys entered on the site should be considered compromised and revoked immediately. Affected users should transfer cryptocurrency assets to new wallets using uncontaminated devices and monitor accounts for unauthorized transactions. System scans for malware or unauthorized software installations are recommended, particularly if files were downloaded from the domain. Additionally, users should verify the authenticity of any Ledger-related communications and avoid clicking on unsolicited links, even if they appear to originate from trusted sources.