ldgrapp-live[.]wixstudio[.]com

PhishDestroy’s threat intelligence team has flagged ldgrapp-live.wixstudio.com as an active credential-harvesting domain designed to trick users into surrendering login credentials. The site mimics a legitimate Wix-hosted application, leveraging the trust associated with Wix’s platform to lower user suspicion. Analysis of the domain’s infrastructure reveals a Let’s Encrypt SSL certificate, which may further enhance its credibility by displaying the padlock icon in browsers. The domain resolves to a Google Cloud IP (34.144.206.118), suggesting a cloud-hosted infrastructure likely chosen for its ease of deployment and evasion of traditional IP-based blocking mechanisms. This domain exhibits several red flags that warrant immediate attention. VirusTotal currently shows 0 detections across 95 scanning engines, indicating that signature-based defenses have not yet flagged this threat. The domain was registered through Namecheap, a popular registrar often exploited by malicious actors due to its low barriers to entry and privacy protection services. While the exact creation date is not publicly available, the lack of historical blocklist entries suggests this domain is either newly registered or recently repurposed for malicious activities. The absence of detections on VirusTotal, combined with the use of a legitimate hosting provider (Wix) and SSL certificate, underscores the sophistication of this phishing campaign and its potential to evade detection. Users who have interacted with ldgrapp-live.wixstudio.com should treat it as a compromised session. If credentials were entered, reset passwords immediately for the affected account and any others using the same credentials. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Report the domain to your organization’s security team or to PhishDestroy’s threat intelligence platform for further analysis. Monitor accounts for unusual activity, such as unauthorized logins or data exfiltration, and consider revoking any active sessions tied to the compromised credentials. Proactive measures, such as changing passwords and enabling MFA, can significantly reduce the risk of further exploitation.