ladgar-startcom[.]wixstudio[.]com

PhishDestroy identifies ladgar-startcom.wixstudio.com as a domain actively engaged in a generic phishing campaign, currently categorized as a cryptocurrency drainer impostor. This threat actor leverages a WixStudio subdomain to mimic legitimate crypto services, deceiving users into connecting wallets and authorizing fraudulent transactions. The infrastructure resolves to 34.144.206.118 and utilizes a Let’s Encrypt SSL certificate to appear credible. With zero detections on VirusTotal at the time of analysis, the domain remains under investigation but is already actively luring victims.

This domain presents a significant risk due to its deceptive branding and operational intent to steal cryptocurrency assets. Technical indicators include a VirusTotal score of 4 out of 95 detection engines, indicating evasion of current signature-based defenses. While the exact creation date and registrar details are not provided in public feeds, the lack of reputation on blacklists suggests it is a recently deployed threat. The hosting IP (34.144.206.118) aligns with known dynamic cloud hosting ranges used by malicious actors to rapidly shift operations and avoid takedowns.

Users who have visited ladgar-startcom.wixstudio.com should immediately disconnect any connected wallets and revoke any unauthorized permissions through blockchain explorers or wallet interfaces. Scan devices for malware, review recent transaction logs, and consider rotating private keys if exposure is confirmed. Avoid interacting with any prompts involving crypto transfers or wallet connections on this domain. Report findings to your security team and submit indicators to threat intelligence platforms to support ongoing disruption efforts.