desktop-client[.]wixstudio[.]com

The domain desktop-client.wixstudio.com has been identified as a brand impersonation threat specifically targeting Ledger, a cryptocurrency hardware wallet provider. This domain is designed to deceive users into believing they are interacting with the official Ledger Live Desktop application, potentially facilitating crypto asset theft. As of the latest assessment, the domain has been taken offline, though prior activity warrants continued vigilance. Analysis indicates this domain was flagged by 12 of 95 security vendors on VirusTotal, signaling widespread detection as malicious. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The domain appears on at least one security blocklist and employs technologies such as Wix, React, Google Cloud CDN, and HTTP/3. The SSL certificate is issued by Let's Encrypt, which, while common for legitimate sites, is frequently exploited by threat actors to lend an appearance of legitimacy. The page title, 'Ledger Live Desktop® — Getting Started | Official Ledger,' further corroborates the intent to impersonate the official Ledger brand. Current status confirms the domain has been taken offline, reducing immediate risk to users. However, the infrastructure and tactics observed suggest potential for re-emergence under a similar or altered domain. Users are advised to verify the authenticity of any Ledger-related communications by cross-referencing official sources and avoiding interaction with unsolicited links. Organizations should monitor for similar impersonation attempts, particularly those leveraging cloud hosting and content delivery networks to evade detection. Blocking the associated IP address (34.144.206.118) and domains registered through the same registrar may mitigate future risks from this threat actor.