apps-live-ledgr[.]wixstudio[.]com

The domain apps-live-ledgr.wixstudio.com has been identified as a high-risk phishing resource specializing in brand impersonation, specifically targeting Ledger, a cryptocurrency hardware wallet provider. Analysis of the page title, 'Ledger® Live: Login | Your Wallet®,' confirms the intent to deceive users into believing they are accessing the legitimate Ledger Live platform. This domain is currently offline, though prior activity suggests it was actively used for credential harvesting or crypto asset theft. Infrastructure analysis reveals the domain resolved to the IP address 34.144.206.118, hosted on a platform utilizing Google Cloud infrastructure. The SSL certificate was issued by Let's Encrypt, a common choice among both legitimate and malicious actors. Registration details indicate the domain was provisioned through GoDaddy.com, LLC, a widely used registrar. Detection metrics show the domain was flagged by 10 of 95 security vendors on VirusTotal, while appearing on three distinct security blocklists, including PhishDestroy, PhishingArmy, and OISD. Technologies detected on the domain include Wix, React, Lodash, and HTTP/3, suggesting a modern, dynamically generated phishing interface designed to mimic legitimate web applications. Current status indicates the domain has been taken offline, though the infrastructure remains a potential risk for future abuse. Security teams are advised to monitor for re-registration or re-emergence under similar subdomains or newly registered domains. Organizations should implement blocklist updates to include this domain and its associated IP address in perimeter defenses. End-users are strongly recommended to verify domain authenticity before entering credentials, particularly for cryptocurrency-related services, and to enable multi-factor authentication where available. Proactive monitoring of brand-impersonation campaigns targeting financial and crypto asset platforms is critical to mitigating similar threats.