ledgocmstarts[.]wixstudio[.]com

ledgocmstarts.wixstudio.com is flagged as a generic phishing site with an elevated risk rating. The domain was registered through Wix Studio and its creation date is 17 December 2016, indicating a long‑standing presence. Infrastructure analysis shows it resolves to four NSOne nameservers (dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, dns4.p08.nsone.net), a common configuration for domains hosted on shared services. The domain is listed on one public security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one trusted sinkhole considers it malicious.

VirusTotal scans have returned 7 positive detections out of 91 antivirus engines, demonstrating that multiple independent scanners have observed suspicious behavior associated with the host. The single blocklist listing is consistent with the low visibility of the domain in broader threat feeds, yet the combination of AV positives and PhishDestroy block indicates a non‑trivial threat. No additional intelligence such as page title, SSL certificate details, or HTTP response codes is available in the current dataset, so the exact payload or lure employed by the site cannot be described. Defenders should add the domain to outbound filtering rules, ensure DNS resolvers block it via existing blocklists, and monitor for any traffic to the associated NSOne name servers that may indicate internal compromise.

Network sensors should log any TLS handshake attempts to the NSOne infrastructure, and security teams should consider sinkholing the domain to disrupt potential phishing campaigns. Because the domain is active, continuous re‑evaluation is recommended; any new detections from sandbox or URL‑reputation services should be incorporated into incident response playbooks. In the absence of further content analysis, the precautionary stance is to treat all communications with the domain as malicious.