ledgur-lives[.]wixstudio[.]com

The domain ledgur-lives.wixstudio.com was created on December 17, 2016 and is registered through the Wix Studio platform, indicating the use of a legitimate website‑building service to host a malicious sub‑domain. It resolves to the four NSOne name servers dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that it is being used for malicious activity.

VirusTotal analysis reports that 7 of 91 security vendors have flagged the domain as malicious, providing a detection ratio of roughly 7.7%, which is significant for a generic phishing indicator. The available intelligence does not include Safe Browsing verdicts, OTX tags, SSL certificate details, or HTTP status codes, so the exact content served by the site and any associated payloads remain unknown. Defenders should treat the domain as elevated risk and enforce network‑level blocking, add it to internal URL filtering and DNS sinkhole lists, and monitor for DNS queries to the associated NSOne name servers.

Organizations should also educate users about unsolicited requests for credentials that may originate from sub‑domains of popular web‑hosting services, and encourage reporting of any suspicious login prompts. Ongoing monitoring is recommended to detect potential infrastructure changes or new hosting configurations that the threat actor may employ.