intro-ledgelive[.]wixstudio[.]com

The domain intro-ledgelive.wixstudio.com has been identified as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis confirms this domain was designed to deceive users into interacting with fraudulent content under the guise of legitimate Ledger Live software tutorials. The domain is currently offline, but prior activity indicates malicious intent consistent with crypto drainer or credential theft operations. Infrastructure analysis reveals the domain was flagged by 10 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. Detected technologies include Wix hosting, React framework, Lodash, and HTTP/3, with a Let's Encrypt SSL certificate providing encryption. The page title, 'Ledger Live: A Complete Tutorial for Beginners,' directly mimics legitimate educational content to lure victims. Current status confirms the domain has been taken offline, reducing immediate risk to users. However, the infrastructure and tactics observed suggest a persistent threat actor. Users are advised to verify all Ledger-related communications through official channels only. Organizations should monitor for similar domains leveraging Wix or cloud hosting platforms for brand impersonation. Security teams should update blocklists to include this domain and its associated IP address, while remaining vigilant for renewed activity under similar naming conventions or infrastructure.