startapp-ledgar[.]wixstudio[.]com

This domain, startapp-ledgar.wixstudio.com, is identified as a credential theft phishing site. Analysis indicates no direct brand impersonation or crypto drainer kit association, but the infrastructure was actively used to harvest login credentials through deceptive landing pages. The domain leveraged Wix Studio hosting, a common tactic to blend malicious content with legitimate web infrastructure, increasing the likelihood of evading initial detection by users and automated systems. Infrastructure analysis reveals the domain resolved to IP address 34.144.206.118 and was registered through GoDaddy.com, LLC on June 11, 2026. The SSL certificate was issued by Let's Encrypt, providing a false sense of security. At the time of assessment, 14 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appeared on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. Google Safe Browsing status was not explicitly provided, but the blocklist presence suggests active malicious classification. The domain is currently offline, likely taken down following detection and reporting. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to takedown. Organizations should update security controls to block the domain and associated IP address. Users who accessed the site should assume credential exposure and initiate password resets for affected accounts. Continuous monitoring for related infrastructure is recommended, as threat actors frequently re-establish operations under new domains or hosting providers.