ldgroe-homepage[.]wixstudio[.]com

The domain ldgroe-homepage.wixstudio.com has been identified as a credential theft operation targeting users through deceptive login prompts. Analysis confirms the domain is currently offline, though prior activity suggests it was actively harvesting authentication details before takedown. Infrastructure analysis reveals the domain was flagged by 13 of 95 security vendors on VirusTotal, indicating widespread detection. It was registered through GoDaddy.com, LLC on May 20, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. The domain resolved to IP address 34.144.206.118, hosted on Google Cloud infrastructure with technologies including Wix, React, and Google Cloud CDN. It appeared on two security blocklists (PhishDestroy and OISD) and received a trust score of 0/100 from Gridinsoft. The SSL certificate was issued by Let’s Encrypt, a common but not exclusive indicator of legitimate domains. While the domain is now offline, organizations should monitor for residual threats. Network administrators are advised to block the domain and associated IP (34.144.206.118) at perimeter defenses. Review logs for prior connections to ldgroe-homepage.wixstudio.com, particularly from May to June 2024, to identify potential credential exposure. Given the anomalous creation date, investigate for additional spoofed domains registered under similar patterns. End-users should be alerted to credential theft risks and instructed to reset passwords if interaction with the domain is suspected.