ladgrlive-eng[.]wixstudio[.]com

PhishDestroy identifies ladgrlive-eng.wixstudio.com as an active credential theft domain designed to mimic legitimate login portals. The domain leverages WixStudio infrastructure to host deceptive forms that harvest usernames and passwords under the guise of authentication processes. Security analysis indicates this infrastructure is part of a broader campaign targeting users through social engineering tactics, with the ultimate goal of unauthorized account access and potential follow-on attacks such as financial fraud or data exfiltration. The threat actor behind this domain utilizes free TLS certificates from Let's Encrypt to establish false trust indicators, while the hosting infrastructure resolves to a Google Cloud IP address (34.144.206.118) that has not yet been widely flagged by security vendors despite clear malicious intent evident in the domain's naming convention and operational behavior.

Technical indicators further substantiate the threat classification. VirusTotal scanning engines currently show 0 detections out of 95 possible flags, indicating this domain has evaded traditional signature-based detection mechanisms. The infrastructure operates on legitimate cloud hosting services with IP geolocation in the United States, which complicates immediate blocking based on geofencing alone. The domain's creation date has not been publicly disclosed in passive DNS records, suggesting recent deployment consistent with active credential harvesting operations. While specific blocklist counts are not publicly available, the domain's complete absence from VirusTotal detections combined with its active infrastructure status warrants immediate caution and proactive blocking by security teams.

Users who have visited this domain should immediately check their accounts for unauthorized access and change passwords to strong, unique credentials. Enable multi-factor authentication wherever possible to provide additional security layers. If any credentials were entered, immediately rotate passwords and monitor accounts for suspicious activity. Security teams should block this domain at the network perimeter and investigate any internal DNS resolutions to this IP address. Report this domain to your security vendor and consider submitting indicators to threat intelligence platforms. Exercise heightened vigilance for similar domains using WixStudio or similar legitimate website builders for malicious purposes, as attackers frequently exploit these platforms to rapidly deploy credential theft infrastructure while maintaining operational flexibility.