platform-ledzrcdn[.]wixstudio[.]com

This domain, platform-ledzrcdn.wixstudio.com, is actively impersonating Ledger Live, a popular cryptocurrency hardware wallet interface, to deploy a crypto drainer threat. The site prompts visitors to connect their wallets under the guise of account verification or firmware updates, then executes unauthorized transactions to siphon funds. Analysis indicates the threat specifically targets users of Ledger hardware wallets, leveraging social engineering tactics to exploit trust in the brand. The domain employs realistic UI elements, including cloned login screens and transaction prompts, to deceive victims into authorizing malicious smart contracts. Infrastructure analysis reveals the domain resolves to the IP address 34.144.206.118 and is hosted on WixStudio's platform, a common vector for phishing due to its accessibility and SSL certificate provisioning. The SSL certificate is issued by Let's Encrypt, a legitimate certificate authority, which adds a layer of perceived legitimacy. As of the latest assessment, the domain has evaded detection on VirusTotal, with 0 out of 95 security vendors flagging it as malicious. No blocklist entries or historical abuse reports were identified at the time of analysis. The domain's creation date and registrar details remain obscured due to the hosting provider's privacy policies, but the active status and lack of prior detections suggest a recently deployed campaign. Users who have visited platform-ledzrcdn.wixstudio.com or interacted with its content should immediately revoke any wallet permissions granted to the site via their wallet's connected apps or dApp browser settings. It is critical to check transaction histories for unauthorized transfers and transfer remaining funds to a new, secure wallet address. If credentials or recovery phrases were entered, assume full compromise and migrate all assets to a new wallet immediately. Monitor accounts for suspicious activity and report the domain to relevant abuse channels, including cryptocurrency transaction tracking services and the hosting provider. Avoid clicking on any links associated with this domain and educate peers about the threat to prevent further victimization.