startedsso-ledzercdn[.]wixstudio[.]com

This domain, startedsso-ledzercdn.wixstudio.com, is flagged as a generic phishing infrastructure under active investigation. Analysis indicates it is designed to mimic single sign-on (SSO) authentication portals, likely targeting corporate or cloud service credentials. The domain name incorporates deceptive subdomains (startedsso-ledzercdn) to simulate legitimate identity provider endpoints, a common tactic in credential harvesting campaigns. No specific brand impersonation or drainer kit signatures have been confirmed at this stage, though the structure suggests a focus on enterprise or SaaS credential theft. Infrastructure analysis reveals the domain is hosted on a Wix Studio platform, utilizing a Let’s Encrypt SSL certificate for encrypted communications. It currently resolves to the IP address 34.144.206.118, which is associated with cloud hosting providers. As of the latest scan, VirusTotal reports 0 detections out of 95 security engines, indicating the domain has not yet been widely flagged. No creation date metadata is publicly available, and the domain remains unlisted on Google Safe Browsing (GSB) or major blocklists. The registrar details are obscured by the Wix Studio platform, limiting visibility into ownership or registration timelines. The domain remains active and operational, with no takedown or sinkholing actions observed. Given the zero-detection status on VirusTotal and absence from blocklists, the infrastructure poses a moderate-to-high risk to users unfamiliar with SSO phishing tactics. Organizations are advised to implement network-level blocking of 34.144.206.118 and monitor for connections to startedsso-ledzercdn.wixstudio.com in proxy or DNS logs. Endpoint protection should be updated to include this domain in phishing detection rules, and users should be trained to verify SSO portal authenticity before entering credentials.