started-ledge-live[.]wixstudio[.]com

This domain is flagged as an elevated-risk generic phishing site designed to impersonate legitimate Wix Studio infrastructure. Analysis indicates the domain was likely created to deceive users into submitting credentials or sensitive information under the guise of a trusted platform, despite its current offline status. The specific threat type involves brand impersonation, leveraging Wix’s recognizable subdomain structure to appear authentic. Infrastructure analysis reveals the domain was registered on April 28, 2026, through GoDaddy.com, LLC, an unusual future date suggesting potential domain spoofing or misconfiguration. It resolves to IP address 34.144.206.118 and employs a Let’s Encrypt SSL certificate, which, while standard for encryption, does not validate legitimacy. The domain is detected by 5 out of 95 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. Technologies detected include Wix, Envoy, React, Google Cloud, and Google Cloud CDN, which align with legitimate Wix infrastructure but are exploited here for phishing purposes. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (34.144.206.118) at the network perimeter. Organizations should update security blocklists to include this domain and monitor for any attempts to re-register or re-host it under a different subdomain or top-level domain. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly if they resemble Wix login portals. Security teams should also review logs for connections to the domain or IP, as well as any indicators of credential harvesting or unauthorized data access. Given the domain’s offline status, proactive monitoring for similar impersonation attempts using Wix or other SaaS platforms is recommended.