ledgarstartcom[.]wixstudio[.]com

Analysis as of July 25 2026 indicates that the sub‑domain ledgarstartcom.wixstudio.com is currently active and resolves to the IPv4 address 162.159.143.12. Registration data shows the domain was created through Wix.com Ltd., a widely used website‑builder platform. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy threat‑intelligence feed. VirusTotal records reveal that the host was scanned by 91 AV engines; none of the engines reported a detection at the time of the scan.

While the absence of detections does not confirm benign intent, it also does not provide a concrete malicious signature. No public Safe Browsing, OTX, SSL certificate, HTTP status code, or page‑title information is presently available for the host, and the nameserver query returned “NS_NOT_FOUND”, indicating that standard DNS delegation data could not be retrieved. No SSL certificate metadata or HTTP response headers have been observed, and the page title has not been harvested by automated crawlers. The limited visibility means that the precise phishing payload, targeted brand, or credential‑harvesting technique remains unverified.

Given the active resolution, the registrar affiliation with a legitimate SaaS provider, and the presence on a known phishing blocklist, defensive teams should treat the domain as high‑confidence malicious. Recommended actions include adding the domain and its resolved IP address to network‑level deny lists, monitoring outbound DNS queries for the host, and employing URL‑filtering solutions that reference the PhishDestroy feed. Continuous re‑scanning with multi‑engine services and periodic checks of the IP reputation are advised to capture any changes in the payload or detection status. Until further forensic analysis provides additional indicators, the domain should be considered a hostile phishing resource.