ldagr-livesafe[.]wixstudio[.]com

This domain, ldagr-livesafe.wixstudio.com, was identified as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The site replicated the official Ledger Live login interface, presenting a page titled "Ledger® Live: Login | Your Wallet®" to deceive users into submitting sensitive credentials. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft operations designed to compromise wallet access and facilitate unauthorized transactions. Analysis indicates the domain was registered through GoDaddy.com, LLC and resolved to IP address 34.144.206.118 at the time of investigation. VirusTotal detection metrics show 14 out of 95 security vendors flagged the domain as malicious. The domain appears on three independent security blocklists: PhishDestroy, PhishingArmy, and OISD. Infrastructure analysis reveals the use of Wix hosting, React for frontend development, and Google Cloud with HTTP/3 support, suggesting a professionally constructed phishing campaign. The SSL certificate was issued by Let’s Encrypt, providing a false sense of security to potential victims. The domain has since been taken offline, reducing immediate exposure risk. However, the infrastructure remains a concern, as similar domains may reappear under different names or hosting providers. Users who interacted with this domain should assume credential compromise and take immediate action, including revoking wallet access, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include the resolved IP and associated indicators to prevent future access attempts. The risk level remains elevated due to the targeted nature of the campaign and the potential for financial loss.