ledegr-comstart[.]wixstudio[.]com

PhishDestroy flags ledegr-comstart.wixstudio.com as a credential-phishing domain impersonating a legitimate login workflow. The site is still active and has been cataloged with a unique seed of dc7cd1 for continuous tracking. Given its live status and the absence of current antivirus coverage, the risk level is currently under_investigation, but the focus remains on the specific risk of stolen user credentials.

This domain carries a known-bad reputation; it appears on PhishingArmy’s blocklist and resolves to IP 34.144.206.118. The certificate authority is Let’s Encrypt, which raises no immediate red flags but does underscore the need for cautious verification. VirusTotal shows zero detections out of 95 engines, indicating evasion of signature-based defenses. The hosting environment (WixStudio) and certificate issuance both complicate quick takedown, requiring behavioral and network indicators for mitigation.

Mitigation should prioritize user education: instruct recipients to hover over links and verify the exact domain before entering credentials. Network defenders can implement DNS sinkholing against 34.144.206.118 and block ledegr-comstart.wixstudio.com via firewall rules. Because the page mimics a login sequence, emphasize multi-factor authentication to reduce the impact of any credentials that may be harvested. Monitor for new hostnames or IP changes as adversaries often shift infrastructure to evade detection.