startcom-ledgecdn[.]wixstudio[.]com

This domain, startcom-ledgecdn.wixstudio.com, is under investigation for credential theft phishing activity targeting users through deceptive login portals. Analysis indicates the infrastructure is designed to harvest account credentials by mimicking legitimate authentication interfaces, potentially affecting corporate or personal accounts. The domain currently resolves to the IP address 34.144.206.118 and remains operational, suggesting ongoing malicious intent. Infrastructure analysis reveals the domain is hosted on a content delivery network associated with a website builder platform, which may explain its low detection rate. As of the latest scan, VirusTotal reports 0/95 security vendors flagging the domain as malicious, indicating it has evaded widespread detection. The SSL certificate is issued by Let's Encrypt, a common provider for both legitimate and malicious sites, and no historical blocklist entries or creation date anomalies have been identified. The lack of prior alerts suggests this may be a newly deployed or low-volume campaign. Users who have visited startcom-ledgecdn.wixstudio.com or entered credentials on any page hosted under this domain should immediately reset passwords for all potentially exposed accounts, particularly those sharing the same credentials. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor financial and communication accounts for suspicious activity, as stolen credentials may be exploited for follow-up attacks. Organizations should block the domain and associated IP (34.144.206.118) at the network level to prevent further exposure. If corporate credentials were entered, report the incident to internal security teams for forensic analysis.