eng-ledgrestart[.]wixstudio[.]com

This domain, eng-ledgrestart.wixstudio.com, is flagged as an elevated-risk credential harvesting phishing site designed to deceive users into submitting login credentials. Analysis indicates the infrastructure was configured to impersonate legitimate services, likely targeting corporate or financial users through fake authentication portals. The threat type is classified as generic phishing with a focus on credential theft, a common tactic used to gain unauthorized access to sensitive accounts or systems. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain is registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, hosted on Google Cloud with HTTP/3 and Google Cloud CDN technologies. It was created on April 27, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. Security vendors on VirusTotal flagged the domain at a 6/95 detection rate, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. Despite currently displaying a 404 error page, historical or cached versions may still contain active phishing content. Mitigation steps should focus on preventing user exposure to this threat. Network administrators are advised to block the domain and its resolving IP address (34.144.206.118) at the firewall or DNS level to prevent access. Endpoint protection systems should be updated to include this domain in phishing and malicious site filters. Security teams should conduct a retrospective analysis of logs to identify any prior interactions with the domain, particularly POST requests or credential submissions. User awareness training should emphasize the risks of entering credentials on unfamiliar sites, even those hosted on seemingly legitimate platforms like Wix Studio. Additionally, organizations should monitor for similar domains using the same infrastructure or naming patterns, as threat actors often reuse hosting providers and CDN services for multiple campaigns.