liveus-started[.]wixstudio[.]com

The domain liveus-started.wixstudio.com has been identified as a high-risk brand_impersonation threat specifically targeting Ledger, a well-known cryptocurrency hardware wallet provider. Analysis confirms the domain was designed to mimic the official Ledger Live application, as evidenced by the page title 'Lédg𝔢r® Live | Official Ledger Mobile & Desktop Application,' which employs Unicode characters to closely resemble the legitimate brand. Currently, the domain is offline, but prior activity indicates malicious intent to deceive users into disclosing sensitive credentials or installing fraudulent software. Infrastructure analysis reveals the domain was flagged by 14 of 95 security vendors on VirusTotal, a significant indicator of malicious activity. It appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, further corroborating its fraudulent nature. The domain resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and was registered through GoDaddy.com, LLC. Detected technologies include Wix, Envoy, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3 support. The SSL certificate is issued by Let's Encrypt, a common but not exclusive indicator of legitimacy, as threat actors frequently leverage valid certificates to evade detection. Given the domain's current offline status, immediate risk to end-users is mitigated; however, the infrastructure and tactics observed warrant caution. Users and organizations are advised to block the domain and its associated IP address (34.144.206.118) at the network level to prevent potential re-emergence. Security teams should monitor for similar impersonation attempts, particularly those leveraging Unicode spoofing in domain names or page titles. End-users should verify the authenticity of any Ledger-related communications by accessing official channels directly and avoid interacting with unsolicited links or applications.