ldger-appstarted[.]wixstudio[.]com

PhishDestroy has flagged ldger-appstarted.wixstudio.com as an active phishing domain engineered to masquerade as a legitimate application login portal. The site is hosted within WixStudio’s infrastructure and is currently serving a spoofed authentication interface designed to harvest user credentials under the guise of a routine app-start process. Security telemetry indicates the domain resolves to a single Google Cloud IP (34.144.206.118) and is secured with a Let’s Encrypt SSL certificate, increasing its perceived legitimacy while masking its malicious intent. The campaign is believed to leverage typosquatting and social-engineering tactics to lure victims into surrendering sensitive login information. Analysis of known threat intelligence reveals this domain remains undetected across major antivirus engines, with 5 out of 95 scanners currently flagging it as malicious. The domain was registered recently and is hosted on a reputable platform, complicating early detection. While specific creation dates and registrar details are still under investigation, this low-detection profile highlights the evolving nature of such attacks. The absence of blocklist entries underscores the urgency for proactive monitoring and immediate user awareness. If you or your users have accessed this domain, assume credentials entered have been compromised. Disconnect from the network immediately, reset all related passwords using a clean device, and enable multi-factor authentication where available. Report the incident to your security team and monitor accounts for unusual activity. Organizations are advised to block the domain at the network perimeter and update endpoint detection rules based on this advisory to prevent further exposure.