open-liveleder[.]wixstudio[.]com

The domain open-liveleder.wixstudio.com has been identified as a phishing site specifically designed to impersonate the Ledger Live cryptocurrency wallet interface. Analysis confirms this as a credential and crypto asset theft operation, currently marked as offline. The site was engineered to deceive users into entering sensitive wallet recovery phrases or private keys, enabling attackers to drain funds from connected wallets. Infrastructure analysis reveals the domain was registered on April 03, 2026, through GoDaddy.com, LLC, a common registrar for both legitimate and malicious domains. It resolves to the IP address 34.144.206.118, hosted on a platform that has previously been associated with phishing campaigns. The domain is flagged by 15 of 95 security vendors on VirusTotal, indicating moderate detection coverage across the security community. Additionally, it appears on one security blocklist, further corroborating its malicious classification. The SSL certificate is issued by Let's Encrypt, a widely used certificate authority that provides encryption but does not validate the legitimacy of the site content. As of the latest assessment, the domain has been taken offline, reducing immediate risk to end users. However, similar phishing infrastructure may re-emerge under different domains or subdomains. Users are advised to verify the authenticity of any cryptocurrency wallet interface by cross-referencing official domain listings and avoiding links from untrusted sources. Organizations should update security blocklists to include this domain and monitor for related indicators of compromise. Cryptocurrency holders should enable multi-factor authentication and use hardware wallets to mitigate the risk of credential theft.