download-ledgu[.]wixstudio[.]com

PhishDestroy identifies download-ledgu.wixstudio.com as a live credential-harvesting endpoint currently undergoing active analysis. The site masquerades as a legitimate download portal but is engineered to trick visitors into surrendering usernames and passwords. This subdomain was registered within the last 48 hours and remains undetected by every antivirus engine on VirusTotal, highlighting its novelty and the urgency for immediate defensive action.

Technical indicators confirm the threat: the domain resolves to the Google Cloud IP 34.144.206.118 and presents a valid Let’s Encrypt TLS certificate to appear benign. With zero detections out of 95 scanners, the kit is still in its infancy, giving defenders a narrow window to block or sinkhole traffic before widespread compromise occurs. The registrar record shows a private registration, obscuring the true actor behind the campaign.

If you or anyone in your organization visited download-ledgu.wixstudio.com, immediately rotate any credentials that may have been entered and enable multi-factor authentication on all accounts. Report the visit to your security team and scan local endpoints for follow-on malware or unauthorized sessions. Block the domain and IP at the firewall and update DNS sinkholes to prevent further exposure. Time is critical—act within the next 24 hours to mitigate potential downstream breaches.