official-ldgrolive[.]wixstudio[.]com

This domain is flagged for elevated-risk credential harvesting phishing activity targeting users through deceptive login portals. Analysis indicates the infrastructure was designed to mimic legitimate services, likely to capture sensitive authentication details such as usernames, passwords, or multi-factor authentication codes. The domain exhibits characteristics consistent with phishing campaigns, including the use of free hosting services and SSL certificates to appear legitimate while concealing malicious intent. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolves to IP address 34.144.206.118, hosted on Google Cloud infrastructure. It was created on June 12, 2026, an anomalous future date suggesting possible domain spoofing or registry manipulation. VirusTotal detection shows 4 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on 3 security blocklists, including PhishDestroy, PhishingArmy, and OISD. Detected technologies include Wix, React, Google Cloud, Lodash, HSTS, Google Cloud CDN, and HTTP/3, with a Let's Encrypt SSL certificate. The page currently returns a 404 error, indicating it may have been taken offline or moved to evade detection. Mitigation requires immediate action to prevent credential compromise. Network administrators should block the domain and its resolving IP (34.144.206.118) at the firewall or DNS level. End users who may have interacted with the domain should reset passwords for any accounts accessed during the exposure window, prioritizing accounts with financial or administrative privileges. Enable multi-factor authentication where available, using app-based or hardware tokens instead of SMS-based methods. Organizations should conduct a retrospective review of authentication logs for the resolving IP and domain to identify potential unauthorized access attempts. Security teams should monitor for similar domains using Wix Studio infrastructure or the same IP range, as threat actors often reuse hosting providers for phishing campaigns.