ldger-starte[.]wixstudio[.]com

A recently detected phishing domain is luring users with a fake login portal impersonating a legitimate financial service. The site, hosted on Wix's platform, is designed to steal credentials by presenting a convincing replica of a login page. Unsuspecting visitors may enter their banking or personal details, exposing themselves to direct financial theft or identity fraud. Given its active status and low detection rate, this domain represents a clear and present danger to anyone who accesses it.

This domain first came to attention after showing 0 detections out of 95 engines on VirusTotal, despite its suspicious behavior. It resolves to IP address 34.144.206.118 and uses a Let’s Encrypt SSL certificate to appear legitimate. Domain registration details indicate recent creation, though exact registration date is still under verification. The use of Wix’s hosting infrastructure is notable, as legitimate services rarely rely on consumer-grade platforms for sensitive authentication flows.

If you’ve visited this domain or entered any credentials, immediately change your passwords on all accounts using the same or similar details. Use a password manager or two-factor authentication where available. Scan your devices for malware using up-to-date security tools, as phishing pages may drop keyloggers or steal session cookies. Report the incident to your organization’s SOC team or to the legitimate service being impersonated. Never reuse passwords across sites, and consider enabling account activity alerts for early warning of unauthorized access.