officialapp-ledgr[.]wixstudio[.]com

PhishDestroy identifies campaign seed 4973fa leveraging Wix-hosted domain officialapp-ledgr.wixstudio.com to impersonate Apple’s brand and harvest Apple ID credentials. The page mimics the legitimate iCloud login portal, tricking users into submitting usernames and passwords under the guise of account verification. No drainer kit artifacts detected during initial inspection; threat is limited to credential harvesting via spoofed interface. Domain technical indicators confirm increasing risk: VirusTotal score remains 3/95 detections, registrar is Wix.com, resolving IP is 34.144.206.118, and Google Safe Browsing currently lists the domain as not flagged. Creation date and additional blocklist counts are pending further enumeration from historical DNS and threat intelligence feeds. Campaign status remains active as of latest scan. Immediate actions include domain blacklisting, SSL certificate revocation via Let’s Encrypt, and IP de-listing. Remaining risk is high due to low AV detection and continued accessibility; users are advised to validate URLs manually and avoid clicking embedded links in unsolicited messages.