desktops-lives[.]wixstudio[.]com

Analysis of desktops-lives.wixstudio.com, observed on July 23, 2026, indicates a confirmed brand‑impersonation campaign targeting Ledger. The site was registered through GoDaddy.com, LLC and is hosted on a Wix infrastructure that resolves to IP 199.15.163.145, an address assigned to AS58182 (Wix.com Ltd.) in the United States. The domain uses a Let’s Encrypt YR1 certificate and serves content over HTTP/3, with technology fingerprints identifying Wix, React, Google Cloud, and Google Cloud CDN. The page title returned by the server is “Ledger® Live: Desktop® — Getting Started | official Ledger™”, directly mirroring the legitimate Ledger branding. The HTTP response code is 404, and the site is currently taken offline, as confirmed by the PhishDestroy blocklist entry.

The domain appears on a single security blocklist and has been flagged by 11 of 91 VirusTotal scanners, reinforcing the malicious classification. Nameservers are dns1.p08.nsone.net through dns4.p08.nsone.net, consistent with typical Wix deployments. No additional content has been captured, so the exact phishing page layout, credential‑capture mechanisms, or redirect behaviour remain unknown. However, the combination of brand‑specific title, impersonation label, and detection history provides sufficient confidence for defensive teams to treat the domain as hostile.

Defenders should ensure that any outbound connections to 199.15.163.145 are blocked at the network perimeter, update URL filtering and proxy rules to include desktops‑lives.wixstudio.com, and add the domain to internal blocklists. Endpoint security solutions that reference VirusTotal or similar threat‑intel feeds should be configured to quarantine or alert on any process that attempts to resolve or communicate with this host. Continuous monitoring of the associated IP range and the Wix hosting provider is advised, as adversaries may spin up additional domains on the same infrastructure.