us-ledgenew[.]wixstudio[.]com

The domain us-ledgenew.wixstudio.com has been identified as a brand impersonation threat targeting Ledger, a provider of cryptocurrency hardware wallets. Analysis indicates the site was designed to mimic Ledger’s official onboarding portal, as evidenced by the page title 'Official | ledger live | Getting Started®.' The domain is currently offline, but prior activity suggests it was operational for malicious purposes, likely to deceive users into disclosing sensitive information or downloading compromised software. Infrastructure analysis reveals the domain was flagged by 3 of 95 security vendors on VirusTotal, indicating a moderate but confirmed level of malicious detection. It was registered through GoDaddy.com, LLC, and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The domain appeared on one security blocklist and was blocked by PhishDestroy. Technologies detected include Wix, React, Lodash, HSTS, Google Cloud CDN, and HTTP/3, with a Let’s Encrypt SSL certificate providing encryption. No creation date was provided, but the use of Wix Studio suggests recent deployment, as this platform is commonly exploited for rapid, low-effort malicious site creation. Current status confirms the domain has been taken offline, reducing immediate risk to users. However, the infrastructure and techniques observed align with common cryptocurrency scam patterns, particularly those involving fake wallet setup pages or phishing for recovery phrases. Users who accessed this domain should assume potential exposure of sensitive data, including wallet credentials or personal information. Recommended actions include revoking any associated wallet sessions, monitoring for unauthorized transactions, and verifying the legitimacy of any Ledger-related communications through official channels only. Organizations should update blocklists to include this domain and its resolved IP to prevent future access attempts.