ssostarted-ledzercdn[.]wixstudio[.]com

This domain, ssostarted-ledzercdn.wixstudio.com, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. The infrastructure was configured to impersonate legitimate single sign-on (SSO) portals, a common tactic used to capture usernames, passwords, and multi-factor authentication tokens. Analysis of the page structure and historical redirects indicates the site was engineered to target corporate and personal accounts, likely with the intent of facilitating account takeovers or unauthorized access to connected services. Evidence supporting this assessment includes detection by 9 of 95 security engines on VirusTotal, a trust score of 0/100 from Gridinsoft, and presence on 3 security blocklists. The domain was registered through GoDaddy.com, LLC on June 14, 2026, an unusually forward-dated registration that may indicate an attempt to evade temporal-based reputation filters. It resolved to the IP address 34.144.206.118 and was hosted on infrastructure associated with Wix Studio, though the current response is a 404 error page. The domain was blocked by multiple threat intelligence feeds, including PhishDestroy, PhishingArmy, and OISD, further confirming its malicious classification. Users who visited ssostarted-ledzercdn.wixstudio.com should assume their credentials were compromised. Immediate actions include resetting passwords for any accounts accessed or entered on the site, enabling multi-factor authentication where available, and monitoring connected accounts for unauthorized activity. System scans using updated endpoint protection tools are recommended to detect potential follow-on malware or persistence mechanisms. Organizations should review logs for connections to 34.144.206.118 and the domain itself, and consider revoking session tokens associated with the timeframe of exposure. If financial or sensitive data was submitted, additional monitoring for identity theft or fraud is advised.