essoapps-liveledgr[.]wixstudio[.]com

This domain, essoapps-liveledgr.wixstudio.com, was identified as a brand impersonation threat targeting Microsoft. The domain was designed to mimic legitimate Microsoft services, likely to deceive users into disclosing credentials, installing malicious software, or authorizing fraudulent transactions. The infrastructure was hosted on a Wix Studio platform, a common tactic to exploit trusted cloud-based website builders for malicious campaigns. Analysis indicates the domain was constructed to appear authentic, potentially leveraging Microsoft’s branding elements to lower user suspicion during interactions. Evidence supporting the malicious classification includes detection by 13 out of 95 security vendors on VirusTotal, with the domain appearing on at least one security blocklist. The domain was registered through GoDaddy.com, LLC on April 27, 2026, an unusually future-dated creation that may indicate an attempt to evade age-based reputation checks. It resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employed a Let’s Encrypt SSL certificate to present a false sense of security. Technologies detected on the domain include Wix, React, Google Cloud, Google Cloud CDN, and HTTP/3, all of which are legitimate but frequently abused in phishing and brand impersonation schemes. Users who accessed this domain should assume potential exposure to credential theft or malware distribution. Immediate actions include resetting passwords for any accounts accessed after visiting the domain, particularly those associated with Microsoft services. System scans using updated security tools are recommended to detect any installed malware. Organizations should review logs for connections to 34.144.206.118 or the domain itself and block both indicators at the network level. If financial or sensitive transactions were initiated, affected parties should contact their financial institutions to prevent unauthorized access or fraudulent activity.