ledgorcmstart[.]wixstudio[.]com

This domain, ledgorcmstart.wixstudio.com, is identified as a credential phishing page designed to harvest user login credentials through deceptive login portals. Analysis indicates no direct association with a known brand or drainer kit, though the infrastructure leverages Wix Studio for hosting, a platform often exploited for its ease of deployment. The page title, '404 Error: Page Not Found | Wix Studio,' suggests an attempt to disguise malicious activity under a benign error message, a common tactic to evade detection during initial scans. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on April 11, 2026, an unusually future-dated creation that may indicate typosquatting or preemptive registration for malicious use. It resolves to IP address 34.144.206.118, hosted on Google Cloud with HTTP/3 and Google Cloud CDN enabled. The SSL certificate is issued by Let's Encrypt, a legitimate provider frequently abused in phishing campaigns. VirusTotal reports 13 out of 95 security vendors flagging this domain as malicious, while it appears on a single security blocklist. No Google Safe Browsing (GSB) detections are currently recorded. The domain has been taken offline, likely due to hosting provider intervention or registrar suspension. However, residual risk persists as threat actors may re-deploy the phishing kit under a new domain or IP. Organizations should monitor for similar patterns, including Wix-hosted domains with future-dated registrations, Let's Encrypt certificates, and Google Cloud infrastructure. Network defenders are advised to block the domain and associated IP (34.144.206.118) at the perimeter, while end-users should verify login portals via official channels before entering credentials. Continuous monitoring of newly registered domains with analogous characteristics is recommended to preempt further abuse.