live-ldgrap[.]wixstudio[.]com

This domain is flagged as a high-risk credential theft operation targeting users through deceptive login portals. Analysis indicates the site was designed to harvest account credentials by impersonating legitimate authentication interfaces, a common tactic in targeted phishing campaigns. The domain currently displays a 404 error, suggesting it may have been taken down or moved to evade detection, though residual risk remains due to its recent activity. Infrastructure analysis reveals multiple indicators of compromise. The domain, live-ldgrap.wixstudio.com, was registered through GoDaddy.com, LLC on April 23, 2026, an unusually future-dated creation that may indicate fraudulent registration practices. It resolves to IP address 34.144.206.118, hosted on Google Cloud infrastructure with HTTP/3 and Google Cloud CDN technologies. The site is detected by 15 out of 95 security vendors on VirusTotal, while Gridinsoft assigns it a trust score of 0/100. It appears on three security blocklists: PhishDestroy, PhishingArmy, and OISD. The SSL certificate is issued by Let's Encrypt, a common but not exclusive indicator of legitimate domains, though its use here does not mitigate the overall threat. Mitigation steps should focus on credential theft prevention. Organizations should block the domain and its associated IP (34.144.206.118) at the network perimeter and update endpoint protection rules to flag any residual connections. Users who may have interacted with the domain should be instructed to reset passwords for any accounts accessed during the exposure window, prioritizing accounts with financial or sensitive data access. Multi-factor authentication (MFA) should be enforced as an additional safeguard. Security teams should review logs for connections to the domain or IP, particularly from April 2024 onward, to identify potential compromise. Given the domain's future-dated registration, monitoring for similar patterns in newly observed domains is recommended.