officialdesktop-legr[.]wixstudio[.]com

The domain officialdesktop-legr.wixstudio.com has been identified as a brand impersonation threat targeting Ledger, a provider of cryptocurrency hardware wallets. Analysis confirms the domain was designed to mimic the official Ledger Live Desktop interface, presenting a high-fidelity replica of the legitimate onboarding process. The domain is currently offline, though prior activity suggests it was operational for a limited period to deceive users into interacting with fraudulent content. Infrastructure analysis reveals the domain resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. It was registered through GoDaddy.com, LLC, and secured with a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and was flagged by 4 of 95 security vendors on VirusTotal. Detected technologies include Wix as the hosting platform, React for frontend development, and Google Cloud CDN for content delivery, further aligning with typical phishing infrastructure patterns. Current status indicates the domain has been taken offline, though residual risk remains due to the potential for re-emergence under a similar or altered domain structure. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. Users who may have interacted with the domain should verify wallet integrity, revoke any suspicious transaction approvals, and monitor for unauthorized access. Proactive measures include deploying endpoint detection rules for Ledger-branded impersonation attempts and educating users on verifying domain authenticity before engaging with cryptocurrency-related interfaces.