appstartio-ledxr[.]wixstudio[.]com

This domain, appstartio-ledxr.wixstudio.com, is flagged as a credential theft operation designed to harvest user login credentials through deceptive web pages. Analysis indicates the site leverages Wix Studio infrastructure, a common platform for legitimate websites, to evade initial suspicion. While no specific brand impersonation or crypto drainer kit signatures were identified in the available data, the domain’s structure and hosting patterns align with credential harvesting campaigns targeting unsuspecting users. The use of Wix’s subdomain system further complicates detection, as it blends with legitimate traffic and benefits from the platform’s built-in SSL encryption and content delivery network. Infrastructure analysis reveals critical technical indicators associated with this threat. The domain is registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. It was created on May 06, 2026, a future date that suggests either a registration error or an attempt to obscure its true age. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on at least one security blocklist and is currently blocked by PhishDestroy. Technologies detected include Wix, React, Google Cloud, Google Cloud CDN, and HTTP/3, which are consistent with modern phishing infrastructure designed for scalability and evasion. As of the latest assessment, the domain has been taken offline, and its page title displays a 404 error from Wix Studio. While this reduces immediate risk, the infrastructure remains a potential threat vector. The SSL certificate issued by Let’s Encrypt indicates the site was configured for encrypted traffic, a tactic used to lend credibility to fraudulent pages. Users and organizations are advised to treat any prior interactions with this domain as compromised and to monitor for unauthorized access to accounts. Network-level blocking of the resolved IP and domain is recommended to prevent future exposure, as similar infrastructure may be repurposed for additional campaigns.