legerrliv[.]wixstudio[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to deceive users into believing they were interacting with an official Ledger platform, likely for the purpose of credential harvesting or cryptocurrency theft. The domain exhibits characteristics consistent with phishing infrastructure, including the use of a subdomain under a legitimate hosting provider to lend false credibility to the operation. Infrastructure analysis reveals the domain legerrliv.wixstudio.com was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118. The domain was created on December 17, 2016, though the subdomain likely represents a more recent malicious deployment. It is currently offline but was previously detected by 7 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. The domain appears on three security blocklists: PhishDestroy, PhishingArmy, and OISD. The SSL certificate is issued by Let’s Encrypt, a common tactic used to create the illusion of legitimacy while avoiding the cost of a paid certificate. Mitigation steps for this threat type include immediate blacklisting of the domain and its associated IP address across all network security controls. Organizations should update endpoint protection rules to block access to legerrliv.wixstudio.com and monitor for any attempts to resolve or connect to 34.144.206.118. Users who may have interacted with the domain should be instructed to reset credentials for Ledger accounts and any other platforms where the same credentials were reused. Cryptocurrency wallet holders should verify transaction histories for unauthorized activity and consider revoking any suspicious wallet permissions. Security teams should review logs for connections to the domain or IP to identify potentially compromised systems. Due to the brand impersonation tactic, user awareness training should emphasize the risks of interacting with unofficial subdomains, even those hosted on seemingly legitimate platforms.