ldgrliv-enpublic[.]wixstudio[.]com

This domain, ldgrliv-enpublic.wixstudio.com, was designed to impersonate the official Ledger Live desktop application setup process. The site displayed a page titled 'Ledger Live Desktop® — Starting Up Your Device | Ledger™,' mimicking the legitimate Ledger device initialization workflow. Analysis indicates the site likely functioned as a crypto drainer or credential harvester, tricking users into entering recovery phrases or private keys under the guise of device activation. Such attacks typically lead to immediate theft of cryptocurrency assets from connected wallets. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The site used a Let's Encrypt SSL certificate, React for frontend development, and Wix as the underlying platform. At the time of detection, 14 out of 95 security vendors on VirusTotal flagged the domain as malicious. It also appeared on three independent security blocklists, including PhishDestroy and PhishingArmy, confirming its classification as a high-risk phishing resource. Users who visited ldgrliv-enpublic.wixstudio.com should assume their wallet credentials or recovery phrases may have been compromised. Immediate action is required: disconnect any wallets previously connected to the site, transfer remaining assets to a new wallet with a fresh recovery phrase, and monitor all linked accounts for unauthorized transactions. If any sensitive information was entered, consider the original wallet permanently compromised. Enable transaction alerts and review all recent activity for signs of unauthorized access. This domain has since been taken offline, but similar threats may persist under different URLs.