ldger-desktop[.]wixstudio[.]com

PhishDestroy identifies the domain ldger-desktop.wixstudio.com as an active credential harvesting scam posing an elevated risk to users. This domain is currently leveraging a fraudulent setup to mimic legitimate services, likely targeting login credentials or sensitive personal information. The threat actor behind this campaign appears to be using compromised or deceptive subdomains under wixstudio.com to lend false credibility to the operation, a tactic often observed in phishing campaigns to bypass initial scrutiny. This domain was flagged by PhishDestroy with multiple indicators of compromise, including a 4/95 detection rate on VirusTotal, a Let's Encrypt SSL certificate, and resolution to IP address 34.144.206.118. Additionally, the domain is blocked by two security blocklists, PhishingArmy and OISD, highlighting its malicious reputation. While the exact creation date of the domain is not provided in the intelligence, its presence on these blocklists suggests recent activation and ongoing abuse. The low trust scores and high-risk classification further corroborate its involvement in credential harvesting activities, a common objective in phishing operations. Users are strongly advised to avoid interacting with ldger-desktop.wixstudio.com and to verify the legitimacy of any unexpected login prompts or requests for sensitive information. Organizations should ensure their security tools are updated to block this domain and IP address (34.144.206.118) at the network perimeter. For credential harvesting threats, implementing multi-factor authentication (MFA) and user awareness training are critical to mitigating the risk of account compromise. If exposure is suspected, users should immediately change passwords and enable additional security measures for affected accounts.