us-ledgrdesktop-home[.]wixstudio[.]com

PhishDestroy identifies active phishing infrastructure hosted on us-ledgrdesktop-home.wixstudio.com impersonating Microsoft/LinkedIn credential harvesting pages. The domain is configured with a Let's Encrypt SSL certificate and resolves to IP 34.144.206.118, which users may incorrectly trust due to the use of a legitimate certificate authority. The hostile site leverages WixStudio’s cloaking infrastructure to mimic legitimate Microsoft or LinkedIn login portals, tricking victims into submitting account credentials which are immediately exfiltrated via a drainer kit. Static analysis indicates active redirection to external data collection endpoints, consistent with automated credential theft automation.

Technical indicators confirm a clean VirusTotal scan result of 3/95 detections at last check, indicating zero antivirus coverage despite active malicious payload delivery. The domain was registered through an anonymized registrar, obscuring ownership details, and the IP 34.144.206.118 is hosted on Google Cloud Platform, complicating takedown via IP-based blocking. Creation date and registrar details remain obscured; however, the site is flagged in PhishDestroy’s real-time threat feed with a currently active status. The domain has not yet appeared on the Google Safe Browsing (GSB) blocklist, and third-party blocklist aggregator counts reflect zero known detections, enabling ongoing abuse.

The threat remains under active investigation with status marked as 'active.' PhishDestroy’s automated sandbox analysis confirms the drainer kit is actively harvesting Microsoft/LinkedIn account credentials and potentially session tokens, posing immediate risk to enterprise and individual users. Recommended actions include immediate DNS-based blocking of 34.144.206.118 and the domain us-ledgrdesktop-home.wixstudio.com. Users are advised to verify login URLs via official Microsoft/LinkedIn domains before entering credentials. While SSL obfuscates the attack, sandbox detonation reveals the drainer’s true intent. Remaining risk is evaluated as high due to zero detection coverage and active exploitation.