en-download-ldgr[.]wixstudio[.]com

This domain, en-download-ldgr.wixstudio.com, is identified as a brand impersonation threat specifically targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site masquerades as Ledger Live Desktop, a legitimate application used for managing Ledger devices, with the intent to deploy crypto-draining malware. The domain is currently offline but was previously active in distributing fraudulent software under the guise of official Ledger services. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on April 14, 2026, an unusually future-dated creation that may indicate falsified records or administrative error. It resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common but low-trust certificate authority often exploited in phishing campaigns. The domain appears on one security blocklist and is flagged by 17 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. The page title, 'Ledger Live Desktop® — Starting Up Your Device® | Ledger™,' closely mimics official branding to deceive users into downloading malicious payloads. Current status confirms the domain has been taken offline, likely due to takedown efforts or abandonment by threat actors. However, the infrastructure remains a latent risk, as domains impersonating cryptocurrency services often resurface under similar naming conventions. Users are strongly advised to verify the authenticity of any Ledger-related downloads by accessing only the official Ledger website (ledger.com) and cross-referencing digital signatures or checksums. Organizations should monitor for domains resolving to 34.144.206.118 or utilizing Let's Encrypt certificates in conjunction with cryptocurrency-related keywords. Network defenders are recommended to implement DNS-based blocking for this domain and any subdomains, while end-users should report suspicious activity to their security teams or relevant threat intelligence platforms.