beginon-live[.]wixstudio[.]com

This domain, beginon-live.wixstudio.com, is flagged as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site replicates the official Ledger Live login interface, presenting a page titled 'Ledger® Live: Login | Your Wallet®®' to deceive users into entering sensitive credentials. The infrastructure leverages Wix hosting and Google Cloud services, with no evidence of a drainer kit but clear intent to harvest wallet access details. Technical indicators confirm the domain's malicious nature. It holds a VirusTotal detection score of 10/95 security vendors, was registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. The domain appears on three security blocklists, including PhishDestroy and PhishingArmy, and employs a Let's Encrypt SSL certificate. No creation date is available, but the use of HSTS and HTTP/3 suggests an attempt to appear legitimate while obfuscating malicious activity. Currently, beginon-live.wixstudio.com is offline, likely due to takedown actions or hosting suspension. Despite its inactive status, residual risk remains for users who may have interacted with the domain before its removal. Organizations and individuals are advised to monitor for unauthorized access attempts, revoke compromised credentials, and verify the authenticity of any Ledger-related communications. Blocklist integration and endpoint protection updates are recommended to prevent future exposure to similar threats.