xledgrlive[.]wixstudio[.]com

PhishDestroy identifies active domain xledgrlive.wixstudio.com as a Ledger brand impersonation site currently under investigation for crypto-draining operations. The site remains live and accessible, with confirmed SSL encryption issued by Let’s Encrypt and resolution to IP 34.144.206.118. The threat is actively monitored with a unique seed identifier 6437a0.

This domain was flagged by 4 of 95 VirusTotal vendors as of the latest scan, indicating it has not yet been widely detected by automated security systems. The site is hosted on WixStudio under a legitimate platform domain, which underscores the challenge of identifying malicious subdomains within trusted hosting environments. The infrastructure resolves to a Google Cloud IP (34.144.206.118), a common hosting provider for both legitimate and malicious services. While the exact creation date and historical blocklist status are not publicly available, the lack of detections and active status suggest a relatively new or evasive campaign.

PhishDestroy currently classifies this domain as an active threat under investigation, with a risk level categorized as evolving. Users are strongly advised to avoid interacting with this domain or any links associated with it. Always verify URLs through PhishDestroy or official brand channels before entering sensitive information. If you have encountered this domain, report it immediately to enhance collective threat intelligence. Proactive URL verification remains the most effective defense against such impersonation attacks.