connect-ledgecdn[.]wixstudio[.]com

This domain is currently under investigation for hosting a credential harvesting phishing operation targeting enterprise cloud service credentials. Analysis indicates the site employs sophisticated evasion techniques, including legitimate hosting infrastructure and valid SSL certificates, to bypass initial detection mechanisms while actively soliciting sensitive authentication details from victims. Infrastructure analysis reveals the domain connect-ledgecdn.wixstudio.com resolves to IP address 34.144.206.118, hosted on Google Cloud CDN infrastructure. The site employs multiple legitimate technologies including Wix hosting platform, React framework, and HTTP/3 protocol implementation. Despite its malicious purpose, the domain currently shows 0/95 detections on VirusTotal, indicating successful evasion of traditional security scanning mechanisms. The SSL certificate is issued by Let's Encrypt, providing valid encryption while maintaining the appearance of legitimacy. No blocklist inclusions or trust score degradations have been recorded at this time, though the domain remains actively serving phishing content. Mitigation requires immediate action from network security teams. First, implement DNS-based blocking for connect-ledgecdn.wixstudio.com and its resolving IP 34.144.206.118 at perimeter security controls. Second, deploy endpoint protection rules to prevent access to this domain, particularly for devices accessing cloud service portals. Third, monitor for credential reuse attempts from harvested credentials, as phishing campaigns typically exploit stolen credentials within 24-48 hours of collection. Security teams should also investigate potential spear-phishing vectors that may have directed victims to this domain, as credential harvesting operations often employ targeted email campaigns as initial infection vectors. Given the domain's use of legitimate hosting infrastructure, traditional reputation-based defenses may prove ineffective, necessitating behavior-based detection mechanisms that can identify credential submission patterns to unauthorized endpoints.