support-ledgrlive[.]wixstudio[.]com

This domain is flagged as a brand impersonation threat targeting Ledger users through a fraudulent support page titled 'Ledger® Live® — Getting Started™.' The site mimics legitimate Ledger Live software to deceive visitors into entering sensitive credentials, such as wallet recovery phrases or private keys, which could lead to unauthorized access and asset theft. The page was designed to appear authentic, leveraging the official Ledger branding and a seemingly legitimate onboarding process to lower user defenses. Analysis indicates the domain was hosted on infrastructure associated with Wix Studio, resolving to the IP address 34.144.206.118, part of Google Cloud’s network. The site employed technologies including React, Google Cloud CDN, and HTTP/3, with an SSL certificate issued by Let’s Encrypt. It was registered through GoDaddy.com, LLC and appeared on one security blocklist prior to takedown. VirusTotal records show 12 out of 95 security vendors flagged the domain as malicious, confirming its use in phishing operations. If you visited support-ledgrlive.wixstudio.com or entered any credentials, immediately disconnect the affected device from the internet to prevent further data exfiltration. Revoke access to any connected wallets or accounts and transfer assets to a new, secure wallet using a fresh recovery phrase. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to the legitimate Ledger support team and consider filing a complaint with relevant cybercrime authorities. Do not reuse passwords or recovery phrases from the compromised session.