appstart-ledjercm[.]wixstudio[.]com

PhishDestroy identifies appstart-ledjercm.wixstudio.com as a live credential-theft phishing domain currently masquerading as a legitimate startup application portal. The campaign explicitly targets user login credentials through a spoofed interface likely designed to harvest authentication details for subsequent account takeovers. No evidence suggests the deployment of a crypto-drainer kit; instead, the page appears tailored to mimic a business application onboarding flow, increasing the likelihood of successful credential capture from unsuspecting employees or customers.

Technical indicators confirm this domain resolves to IP 34.144.206.118 via a Let’s Encrypt SSL certificate, suggesting an attempt to appear legitimate. VirusTotal analysis shows a low detection ratio of 3 out of 95 security vendors as of the latest scan. The domain is hosted on the WixStudio platform under the subdomain wixstudio.com, a service commonly abused for rapid phishing deployment. Registrar data indicates recent creation with no publicly available creation date provided. Google Safe Browsing (GSB) status remains unclassified, and cross-referencing against PhishDestroy’s internal blocklists reveals minimal prior sightings, indicating a newly activated threat.

Currently, the domain remains active and accessible, with no observed takedown or mitigation from hosting providers. Users who encounter this domain should avoid interacting with any login prompts or data entry fields. Organizations are advised to block traffic to 34.144.206.118 at the network perimeter and inspect endpoints for signs of credential submission to this domain. Remaining risk is elevated due to low vendor detection, the use of a trusted hosting platform, and active accessibility. Proactive threat hunting and user awareness training are strongly recommended to reduce exposure to this credential phishing campaign.