ledgrapp-com[.]wixstudio[.]com

This domain is flagged as a high-risk generic phishing site designed to harvest user credentials or sensitive information. Analysis indicates the infrastructure was actively used for malicious purposes prior to being taken offline, with security vendors classifying it under phishing-related threats. The domain does not exhibit characteristics of legitimate services, despite its use of a well-known website-building platform. Infrastructure analysis reveals multiple technical indicators of compromise. The domain is detected by 12 out of 95 security vendors on VirusTotal, with a creation date of April 15, 2026, suggesting an implausibly future registration likely intended to evade scrutiny. It resolves to the IP address 34.144.206.118, hosted on a cloud provider’s infrastructure, and employs a Let’s Encrypt SSL certificate. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and was registered through a major registrar. Technologies detected include Wix, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3, which may have been leveraged to obfuscate malicious activity. Mitigation steps for users and organizations include immediate blocking of the domain and its associated IP address at the network perimeter. Security teams should review logs for connections to 34.144.206.118 or requests to ledgrapp-com.wixstudio.com, particularly those involving credential submissions or redirects. End-users who may have interacted with the domain should reset passwords for any accounts accessed during the exposure window and enable multi-factor authentication where available. Organizations should also monitor for phishing campaigns leveraging similar subdomain patterns or cloud-hosted infrastructure, as threat actors frequently reuse tactics across multiple domains.