live-starts-ledge[.]wixstudio[.]com

PhishDestroy identifies live-starts-ledge.wixstudio.com as a credential harvesting phishing domain actively impersonating legitimate WixStudio services. This site mimics trusted web hosting interfaces to trick users into submitting login credentials, payment details, or sensitive personal information. The threat actor leverages the WixStudio domain to bypass initial suspicion, as the subdomain (wixstudio.com) is a known legitimate service. Technical analysis reveals the site is hosted on a Google Cloud IP (34.144.206.118) using a Let's Encrypt SSL certificate, which adds a false sense of security. The domain is currently under active investigation but remains unflagged by VirusTotal (4/95 detections), indicating a need for immediate scrutiny by security teams and end-users. This domain was flagged as a high-risk credential harvesting phishing site due to its active status, SSL certification, and hosting infrastructure. The domain resolves to IP 34.144.206.118 (Google Cloud) and utilizes a Let's Encrypt certificate, which may deceive users into trusting the site. VirusTotal currently reports 4/95 detections, suggesting this threat is either newly emerged or employing evasion techniques. The domain's WixStudio subdomain further enhances its credibility, making it a prime candidate for phishing campaigns targeting users of web hosting services. Security teams should cross-reference this domain with internal blocklists and threat intelligence feeds to prevent potential breaches. If you or your organization have interacted with live-starts-ledge.wixstudio.com, take immediate action to secure accounts and systems. Assume credentials submitted to this site are compromised and reset passwords for all associated accounts, including email, banking, and web hosting services. Enable multi-factor authentication (MFA) where possible to add an additional layer of security. Run a full malware scan on devices that accessed the site, as the threat actor may have deployed additional payloads. Report the domain to your IT security team and relevant phishing reporting platforms to aid in broader threat mitigation efforts. Monitor financial accounts and sensitive data for unusual activity, as this phishing campaign may extend beyond credential theft to include financial fraud or identity theft.