ledgren-desktop[.]wixstudio[.]com

This domain, ledgren-desktop.wixstudio.com, is identified as a generic phishing site targeting users of the Wix Studio platform. Analysis indicates the threat was designed to harvest credentials or distribute malicious payloads under the guise of a legitimate Wix service. The domain is currently offline, but prior activity suggests it was operational for malicious purposes. Infrastructure analysis reveals the domain was flagged by 14 of 95 security vendors on VirusTotal, indicating broad detection despite its short-lived activity. It was registered through GoDaddy.com, LLC, and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The domain was created on April 28, 2026, an anomalous future date likely intended to evade temporal detection mechanisms. It appears on one security blocklist and holds a Gridinsoft trust score of 0/100, reinforcing its malicious classification. Technologies detected include Wix, React, Google Cloud, Google Cloud CDN, and HTTP/3, alongside a Let’s Encrypt SSL certificate, which may have been leveraged to appear legitimate. The domain’s current offline status does not eliminate its residual risk. Organizations and users are advised to block the domain and its associated IP (34.144.206.118) at the network level. Security teams should monitor for any re-emergence of the domain or similar patterns, such as subdomains under wixstudio.com or other Wix-related infrastructure. End-users who may have interacted with the site should reset credentials immediately, particularly if they entered login details or downloaded files. Proactive measures include reviewing logs for connections to the domain or IP and updating phishing detection rules to include this indicator of compromise.