live-desktopus[.]wixstudio[.]com

This domain, live-desktopus.wixstudio.com, poses as the official Ledger Live Desktop application to deceive users into entering sensitive credentials or cryptocurrency wallet information. The site displays a fraudulent page titled "Ledger Live Desktop® — Starting Up Your Device | Ledger®®," designed to closely resemble the legitimate Ledger onboarding process. Analysis indicates the infrastructure is engineered to harvest login details, recovery phrases, or private keys under the guise of device initialization, putting users' digital assets at immediate risk of theft. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of this domain. The domain was registered through GoDaddy.com, LLC on April 14, 2026, and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. Security vendors on VirusTotal flagged the domain, with 6 out of 95 engines detecting it as malicious. The site employs a Let's Encrypt SSL certificate and utilizes technologies such as Wix, React, and Google Cloud CDN, which are consistent with phishing campaigns leveraging low-cost, high-availability hosting solutions. Additionally, the domain appears on one security blocklist, further corroborating its classification as a threat. Users who visited live-desktopus.wixstudio.com should take immediate action to mitigate potential compromise. Disconnect the device from the internet to prevent further data exfiltration and revoke any active sessions linked to the site. If credentials, recovery phrases, or private keys were entered, transfer all cryptocurrency assets to a new, secure wallet immediately, as the original wallet may be compromised. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams or platforms that track phishing infrastructure to aid in broader threat mitigation efforts. Avoid interacting with any communications or prompts originating from this domain, as they may contain additional malicious payloads.