starten-live[.]wixstudio[.]com

This domain, starten-live.wixstudio.com, presents a confirmed brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. The site mimics the official Ledger Live application interface, using the page title 'Ledger Live Wallet® | Official Ledger Mobile & Desktop Application' to deceive users into entering sensitive credentials or recovery phrases. Such impersonation schemes are designed to facilitate unauthorized access to cryptocurrency wallets, leading to potential asset theft through wallet-draining attacks. The domain’s infrastructure and content are engineered to exploit trust in the Ledger brand, making it a significant risk to users unfamiliar with official communication channels. Analysis indicates the domain has been flagged by 6 out of 95 security vendors on VirusTotal, a notably low detection rate that underscores the sophistication of the impersonation attempt. The domain is registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure with technologies including Wix, React, and HTTP/3. It appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The SSL certificate is issued by Let’s Encrypt, a common tactic to lend an air of legitimacy to malicious sites. The domain’s current status is offline, but its prior activity and infrastructure remain a concern for historical exposure. Users who visited starten-live.wixstudio.com or interacted with its content should take immediate action to mitigate potential risks. First, revoke any permissions granted to applications or browser extensions associated with the domain. Second, assume that any credentials or recovery phrases entered on the site have been compromised and initiate account recovery procedures through Ledger’s official channels. Monitor cryptocurrency wallets for unauthorized transactions and enable multi-factor authentication where available. If the site was accessed via a corporate or shared device, perform a full system scan for malware and report the incident to internal security teams. Given the elevated risk level, affected users should also consider replacing hardware wallets or regenerating recovery phrases as a precautionary measure.