livestart-legurlive[.]wixstudio[.]com

The domain livestart-legurlive.wixstudio.com was identified as a high-risk phishing infrastructure designed to impersonate Ledger, a provider of cryptocurrency hardware wallets. This domain specifically targets users of Ledger Live, the brand’s official wallet management software, by mimicking its interface and branding. Analysis confirms the domain is currently offline, though it previously operated as an active brand impersonation threat. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on June 11, 2026, and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The domain was flagged by 15 of 95 security vendors on VirusTotal, with detections from multiple anti-phishing engines. It appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The site employed a Let’s Encrypt SSL certificate, React for frontend rendering, and Google Cloud CDN for content delivery. The page title, "Ledger® Live | Your Wallet®®," directly replicates official Ledger branding to deceive users into entering credentials or downloading malicious payloads. Current status indicates the domain has been taken offline, though residual risk remains due to its prior use in credential harvesting or malware distribution. Organizations and individuals are advised to block the domain and IP at network perimeter devices, monitor for related indicators of compromise, and verify any Ledger-related communications through official channels. Users who accessed the domain should assume potential exposure of wallet credentials or personal data and take immediate remedial actions, including revoking access to connected applications and rotating passwords.