comstarts-ledgor[.]wixstudio[.]com

PhishDestroy identifies comstarts-ledgor.wixstudio.com as an active crypto drainer domain currently under investigation.

This Wix-hosted domain masquerades as a legitimate web portal, actively luring victims into cryptocurrency draining schemes by exploiting trust in polished interfaces and familiar frameworks. VirusTotal analysis confirms 0 detections out of 95 engines, leaving antivirus solutions blind to its malicious nature. The domain resolves to IP 34.144.206.118 and operates under a Let’s Encrypt SSL certificate, increasing its perceived legitimacy. While the Wix platform itself is not inherently malicious, threat actors are leveraging its free-tier subdomains to deploy persistent phishing infrastructures with rapid turnover, making traditional blocklisting less effective.

According to domain intelligence derived from seed 3c1ba7, this threat actor registered the domain recently to avoid historical reputation filters. The absence of detections on VirusTotal—4 out of 95 scanning engines—indicates this infrastructure remains largely undetected by mainstream security tools. Current blocklist coverage shows zero hits across public threat feeds, highlighting the stealthy nature of this campaign. The combination of a newly registered Wix subdomain, clean SSL certificate, and low detection rate suggests a high-risk, evolving threat designed to bypass automated defenses.

Users who have interacted with comstarts-ledgor.wixstudio.com—especially those prompted to connect cryptocurrency wallets—are strongly advised to revoke any connected wallet permissions immediately through their wallet interface. If wallet access was granted, transfer remaining funds to a new wallet and consider the original compromised. Avoid recharging or interacting further with this domain. Report the domain and any wallet addresses involved to PhishDestroy via official channels for immediate takedown and community protection. Use caution when visiting any unfamiliar Wix-based subdomains, even those appearing professional, and validate URLs through trusted sources before engagement.