ledzer-liveapps[.]wixstudio[.]com

This domain, ledzer-liveapps.wixstudio.com, is flagged as an active credential theft operation targeting users through deceptive login interfaces. Analysis indicates no direct association with known crypto drainer kits or brand impersonation campaigns, though the site mimics legitimate authentication portals to harvest usernames, passwords, and session tokens. The threat actor appears to rely on social engineering rather than automated exploitation, suggesting a focus on manual credential collection for subsequent unauthorized access or account takeovers. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 34.144.206.118, hosted on a platform that provides SSL certificates via Let's Encrypt. VirusTotal detection remains at 0/95 engines, indicating no current antivirus or security vendor flagging. The domain is registered under Wix Studio's subdomain infrastructure, obscuring direct WHOIS ownership details. Google Safe Browsing (GSB) status is unconfirmed, and no blocklist entries were identified at the time of analysis. Creation date metadata is unavailable due to the subdomain structure, limiting temporal attribution. The domain remains active as of the latest verification, with no takedown or sinkholing observed. Response actions should include immediate submission to security vendors for detection rule updates, particularly those specializing in credential theft and phishing. Network-level blocking of the IP 34.144.206.118 is recommended for enterprise environments, alongside endpoint protection updates to flag the domain. Users are advised to verify login portals via official channels before entering credentials, enable multi-factor authentication (MFA) where available, and report suspicious domains to their organization's security team. The remaining risk is elevated due to the domain's undetected status and active exploitation, requiring proactive monitoring for new variants or associated infrastructure.