ledgreapp-started[.]wixstudio[.]com

This domain, ledgreapp-started.wixstudio.com, is identified as a generic phishing threat designed to impersonate Wix Studio login pages. Analysis indicates the site likely targeted users with fake authentication prompts to harvest credentials, though no specific drainer kit or cryptocurrency-related payloads were confirmed in the available data. The domain leveraged Wix’s hosting infrastructure, which may have contributed to its initial credibility before detection. Infrastructure analysis reveals the following technical indicators: the domain was flagged by 4 out of 95 security vendors on VirusTotal, registered through GoDaddy.com, LLC on May 01, 2026, and resolved to the IP address 34.144.206.118. It appeared on three security blocklists, including PhishDestroy and PhishingArmy, and was assigned a Gridinsoft trust score of 0/100. The SSL certificate was issued by Let’s Encrypt, and technologies detected include Wix, React, Google Cloud, and Google Cloud CDN. Google Safe Browsing status at the time of analysis was not explicitly provided, but the domain’s presence on multiple blocklists suggests prior malicious classification. The domain is currently offline, having been taken down following detection. However, residual risk remains due to the potential reuse of the infrastructure or registration of similar domains. Users who may have interacted with the site are advised to reset credentials for any accounts accessed during the exposure window. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors often reuse infrastructure patterns. The creation date discrepancy (2026) suggests potential domain spoofing or a placeholder in registration records, warranting further scrutiny of associated metadata.