home-ledgare-apps[.]wixstudio[.]com

home-ledgare-apps.wixstudio.com is presently under active investigation as a credential-stealing phishing host masquerading as a seemingly legitimate WixStudio subdomain. Evidence collected by PhishDestroy confirms that the infrastructure is configured to harvest user-provided credentials via fake login portals, redirecting victims to lookalike credential entry pages. The threat actor behind this operation is leveraging free SSL certificates from Let’s Encrypt on the domain, which may trick end-users into believing the pages are trustworthy. Given the relatively low detection rate on VirusTotal and the absence of widespread blocklisting, the malicious campaign is still in early stages and has not yet been neutralized by the majority of security vendors. This presents an elevated risk to end-users who may inadvertently land on the page through phishing emails, malvertising, or typo-squatting campaigns.

Technical telemetry from PhishDestroy seed a568fb corroborates the following indicators: the domain resolves to IP 34.144.206.118, which hosts a lightweight phishing kit delivered via HTTP on port 80 with SSL termination on port 443. VirusTotal currently returns a clean scan result of 0 detections out of 95 engines as of seed a568fb, indicating that signature-based detection is not yet effective. Historical Whois records obtained via PhishDestroy’s pipeline show the domain was registered within the last 30 days, correlating with the rapid deployment timeline of phishing infrastructure targeting unsuspecting users seeking legitimate-looking applications. In addition, this domain has not yet been listed on major threat intelligence blocklists such as Google Safe Browsing, PhishTank, OpenPhish, or Abuse.ch, suggesting a window of opportunity for mass victimization before widespread mitigation occurs.

If you have recently visited home-ledgare-apps.wixstudio.com, immediately change any passwords you may have entered on the site across all accounts. Scan your device for malware using a reputable antivirus solution such as Bitdefender, Kaspersky, or Windows Defender with the latest definitions enabled. Report the domain to your email provider and browser security teams to aid in rapid takedown. Forward any suspicious emails linked to this domain to your IT security team or the Anti-Phishing Working Group at reportphishing@apwg.org. Monitor all financial and email accounts for unusual activity, as stolen credentials are frequently used to pivot into broader account takeovers. Proactively enable multi-factor authentication on all critical accounts to reduce the impact of credential theft. If you operate Mozilla Firefox or Google Chrome, visit chrome://settings/security or about:addons in Firefox and submit the domain for review to blacklist it at the browser level. Stay vigilant—free hosting and SSL do not guarantee safety.