starten-ledgrcdn[.]wixstudio[.]com

This domain, starten-ledgrcdn.wixstudio.com, has been flagged as an active credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates the domain is hosted on a legitimate website builder platform, which is frequently abused to lend credibility to phishing campaigns. No specific brand impersonation has been confirmed at this stage, though the infrastructure suggests potential targeting of financial or corporate credentials. No drainer kit signatures have been identified in initial scans, but further forensic analysis is ongoing to determine payload delivery mechanisms. Infrastructure analysis reveals the domain currently resolves to IP address 34.144.206.118, a cloud-hosted endpoint with no prior malicious associations in public threat feeds. The domain maintains a clean detection profile on VirusTotal, with 0 out of 95 security engines flagging the URL as malicious. SSL certificate inspection confirms the use of a Let's Encrypt certificate, valid and automatically issued, which is consistent with both legitimate and malicious sites. No Google Safe Browsing (GSB) flags have been recorded, and the domain remains unlisted on major blocklists. Creation metadata is obscured due to the use of a subdomain on a third-party platform, limiting visibility into registration details. Current status remains active, with the phishing page still serving content as of the latest verification. Response actions include submission to additional threat intelligence platforms for broader detection coverage and monitoring for changes in hosting infrastructure. The remaining risk is assessed as elevated due to the domain's operational status, clean detection profile, and use of legitimate hosting services, which may delay automated blocking. Users are advised to exercise caution with any login prompts originating from this domain, particularly those mimicking corporate or financial authentication portals. Network administrators should consider implementing temporary blocks on the resolved IP address and monitor for related subdomains on the same hosting platform.