webstart-ldger[.]wixstudio[.]com

PhishDestroy identifies webstart-ldger.wixstudio.com as an active credential-harvesting page posing as a login portal. The domain, currently resolving to IP 34.144.206.118 and using a legitimate Let’s Encrypt SSL certificate, is designed to trick users into surrendering usernames and passwords. It masquerades behind a WixStudio hosting service to appear benign, yet its sole purpose is to harvest credentials under the guise of a routine login or account-update flow. This domain was flagged by PhishDestroy’s automated pipeline on seed dda087; VirusTotal currently shows 0 out of 95 engines detecting the threat, indicating it remains under the radar for many scanners. WixStudio is a legitimate hosting platform frequently abused by threat actors to deploy phishing pages quickly and cheaply. The lack of detections suggests the page has recently been stood up or is employing evasion tactics to avoid signature-based detection. If you visited webstart-ldger.wixstudio.com, do not enter any credentials or personal information. Immediately change the password on any account where the same username or email was used, and scan your device for malware. Report the domain to your organization’s SOC or mark it as a phishing site in your email client to help protect others. Monitor financial accounts and enable multi-factor authentication wherever possible to reduce future risk.