getteeng-ledgr[.]wixstudio[.]com

This domain, getteeng-ledgr.wixstudio.com, is flagged as an active credential theft phishing site targeting users through deceptive login interfaces. Analysis indicates the threat type involves harvesting sensitive authentication details, including usernames, passwords, and potentially multi-factor authentication codes, under the guise of legitimate services. The risk level is classified as elevated due to the domain's presence on multiple security blocklists and detection by a significant portion of security vendors. Infrastructure analysis reveals the domain resolves to the IP address 34.144.206.118, hosted on a platform utilizing Wix, React, Google Cloud, and Google Cloud CDN technologies. It is registered through GoDaddy.com, LLC, and secured with a Let's Encrypt SSL certificate. The domain appears on one security blocklist and is flagged by 6 out of 95 security vendors on VirusTotal. Additional trust scoring metrics, such as a Gridinsoft trust score of 0/100, further corroborate its malicious classification. The site was operational until recently taken offline, though historical data suggests it may have been active long enough to capture user credentials. Mitigation against credential theft phishing sites like getteeng-ledgr.wixstudio.com requires a multi-layered approach. Users should verify domain authenticity before entering login details, particularly when redirected from emails or messages. Organizations are advised to implement domain-based message authentication (DMARC, SPF, DKIM) to reduce spoofed communications. Security teams should block the domain and its resolving IP (34.144.206.118) at the network level, while monitoring for credential reuse across internal systems. Endpoint protection solutions should be updated to recognize and block access to known phishing infrastructure, and users should be educated on identifying deceptive login prompts.