ldger-live-desktop[.]wixstudio[.]com

This domain mimics the official Ledger Live desktop interface to trick users into entering their recovery phrases or private keys, enabling direct theft of cryptocurrency funds. The attacker uses the WixStudio platform to host a visually identical replica of the legitimate Ledger Live interface, targeting users who may overlook subtle URL differences or SSL indicators. Common tactics include fake update prompts, urgency messages (e.g., 'Your wallet is compromised'), and spoofed support chat windows to extract credentials. Users who enter their 24-word recovery phrase or private keys risk immediate loss of funds, as these are the master keys to their wallets. The domain leverages cloud hosting (IP 34.144.206.118) with a Let's Encrypt SSL certificate to appear legitimate and avoid initial suspicion.

PhishDestroy identifies this site as a confirmed credential theft phishing page, with VirusTotal reporting only 1 out of 95 security vendors detecting it at the time of analysis. The domain was likely registered recently, exploiting the trust users place in Ledger’s brand reputation. Registrar information indicates use of a privacy-protected service to obscure ownership details, a common tactic among phishing operators. The low detection rate (1.05%) highlights the stealthiness of this campaign, which relies on social engineering rather than overt malware. Technical indicators such as the mismatched domain (wixstudio.com vs ledger-live.com) and the IP geolocation (hosted on Google Cloud in the US) further confirm its malicious nature.

If you visited this site, immediately disconnect from the internet to prevent any data exfiltration. Never enter your Ledger recovery phrase, seed phrase, or private keys into any website or app outside the official Ledger Live application. Scan your device with reputable antivirus software like Malwarebytes or Windows Defender to check for keyloggers or spyware. Revoke any session tokens or API keys exposed during the visit via your Ledger account dashboard. If you entered credentials, transfer your funds to a new wallet immediately using a clean, offline device. Report the domain to Google Safe Browsing (safebrowsing.google.com/report_phish) and Ledger’s official support channels. Always verify URLs manually (ledger.com/live) and enable Ledger’s 'Passphrase' feature for additional security.