startapps-ledgrecdn[.]wixstudio[.]com

The domain startapps-ledgrecdn.wixstudio.com has been confirmed as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the domain is currently offline, though it previously maintained active status as a malicious endpoint. No specific brand impersonation has been conclusively identified, though the infrastructure aligns with common credential theft tactics observed in phishing campaigns. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and secured with a Let's Encrypt SSL certificate, a pattern frequently exploited by threat actors to lend superficial legitimacy. The domain resolved to the IP address 34.144.206.118, a host previously associated with transient phishing operations. Security vendors flagged the domain in 8 of 95 VirusTotal scans, while it appeared on three distinct security blocklists, including PhishDestroy, PhishingArmy, and OISD. The page title, mirroring the domain name, further suggests a lack of legitimate branding, reinforcing its classification as malicious infrastructure. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations are advised to block the domain and associated IP at perimeter security controls, including firewalls and email gateways. End users should reset credentials if login attempts were made on the site, particularly if multi-factor authentication was not enforced. Security teams should monitor for related indicators, including subdomains or redirects, and update detection rules to account for similar infrastructure patterns.