livelegber[.]wixstudio[.]com

This domain, livelegber.wixstudio.com, was confirmed to operate as a credential theft phishing site targeting users through deceptive login portals. Analysis indicates the infrastructure was designed to harvest account credentials by mimicking legitimate authentication pages, likely leveraging social engineering tactics to trick victims into submitting sensitive information. The domain’s hosting on Wix Studio infrastructure suggests an attempt to exploit a reputable platform to evade initial detection while maintaining low operational costs. Evidence supporting this assessment includes detection by 13 out of 95 security vendors on VirusTotal, with the domain appearing on three security blocklists: PhishDestroy, PhishingArmy, and OISD. The domain was registered through GoDaddy.com, LLC, with a creation date of May 05, 2026, which may indicate an attempt to exploit future-dated records for obfuscation. It resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employed a Let’s Encrypt SSL certificate to present a false sense of security. Technologies detected include Wix, React, Google Cloud CDN, and HTTP/3, further confirming its use of modern web frameworks to enhance phishing efficacy. Users who visited livelegber.wixstudio.com should immediately revoke any credentials entered on the site, as they are likely compromised. Monitor accounts associated with the submitted information for unauthorized activity, including financial transactions or identity misuse. Enable multi-factor authentication (MFA) on all critical accounts to mitigate further risk. If the domain was accessed via a corporate or institutional network, report the incident to the internal security team for further investigation and potential remediation. Given the domain’s current offline status, continued monitoring for resurgence or related domains using similar infrastructure is recommended.