setup-ledgre[.]wixstudio[.]com

The domain setup-ledgre.wixstudio.com has been identified as a high-risk phishing resource specifically targeting cryptocurrency users. Analysis confirms this domain operated under the generic_phishing threat classification, with no legitimate association to any recognized financial or blockchain service. At present, the domain has been taken offline, though prior activity suggests it may have impersonated cryptocurrency wallet or exchange platforms to harvest credentials or private keys. Infrastructure analysis reveals the domain was flagged by 14 of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence platforms. The domain was registered through GoDaddy.com, LLC, with a creation date of May 02, 2026, which is anomalous given the current date, suggesting potential domain spoofing or incorrect registration metadata. It resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and was blocked by three major security blocklists, including PhishDestroy, PhishingArmy, and OISD. Additional technical indicators include a Gridinsoft trust score of 0 out of 100, the use of a Let's Encrypt SSL certificate, and detection of technologies such as Wix, React, RequireJS, Lodash, HSTS, Google Cloud CDN, and HTTP/3. The page title, '404 Error: Page Not Found | Wix Studio,' suggests either a cloaking mechanism or a defunct phishing page at the time of analysis. Current status indicates the domain is offline, reducing immediate risk to end users. However, the infrastructure and registration patterns observed warrant continued monitoring. Users are advised to verify all cryptocurrency-related communications through official channels and avoid interacting with domains flagged by multiple security vendors. Network administrators should update blocklists to include this domain and its associated IP address, while security teams should investigate logs for prior connections to 34.144.206.118. Given the high-risk classification, any prior interaction with this domain should be treated as a potential compromise of sensitive credentials or financial data.