lekdger-liveus[.]wixstudio[.]com

This domain, lekdger-liveus.wixstudio.com, was identified as a brand impersonation threat specifically targeting Ledger, a provider of cryptocurrency hardware wallets. The infrastructure was designed to deceive users into believing they were interacting with legitimate Ledger services, likely to facilitate unauthorized access to sensitive credentials or cryptocurrency assets. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was operational long enough to pose a credible risk to unsuspecting users. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was flagged by 13 of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its suspicious nature. It was registered through GoDaddy.com, LLC, a common registrar for both legitimate and malicious domains, and was created on May 20, 2026, suggesting either a typo in the registration date or an attempt to obscure its true age. The domain resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, which is frequently leveraged by threat actors due to its scalability and perceived legitimacy. Additional indicators include its presence on one security blocklist and a Gridinsoft trust score of 0 out of 100, reinforcing its classification as high-risk. The SSL certificate was issued by Let's Encrypt, a free and widely used certificate authority that, while legitimate, is often exploited in phishing campaigns to lend a false sense of security. Technologies detected on the domain include Wix, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3 support, which may have been used to enhance the site's perceived authenticity and performance. The current status of lekdger-liveus.wixstudio.com is offline, as indicated by the 404 error page title returned during the latest scan. However, the infrastructure's prior existence and the technical indicators observed warrant continued vigilance. Organizations and individuals are advised to block the domain and its associated IP address (34.144.206.118) at the network level to prevent accidental access in the event of reactivation. Users who may have interacted with the domain should immediately revoke any connected sessions, reset credentials for Ledger or related cryptocurrency accounts, and monitor for unauthorized transactions. Security teams are encouraged to review logs for connections to the domain or IP address and to update detection rules to include the domain's unique seed identifier (8e5057) for future reference. Given the persistent nature of brand impersonation threats, ongoing monitoring of newly registered domains with similar naming patterns or infrastructure is recommended.