ledgr-startedapps[.]wixstudio[.]com

PhishDestroy’s automated threat pipeline flagged ledgr-startedapps.wixstudio.com as an active credential theft host under investigation (Unique Seed 0087c4). The domain is a Wix Studio subdomain leveraging a Let’s Encrypt SSL certificate to lend superficial legitimacy. While no public-brand impersonation or crypto-drainer kit signature has been confirmed, the page’s design and lures are consistent with generic harvesters targeting login credentials for onward fraud, data breaches, or account takeovers. Initial sandbox analysis revealed form submissions POST to external endpoints, a trademark of credential theft campaigns.

Technical indicators collected on 2024-06-dd reveal a clean 4/95 detection ratio on VirusTotal (last scanned 2024-06-dd 15:42 UTC), a Google Safe Browsing (GSB) status of ‘unlisted’, and the domain resolving to IP 34.144.206.118 via Google Cloud. Domain creation occurred on 2024-05-14, with NameBright serving as registrar. Public blocklist aggregation shows 0 third-party listings at the time of writing, indicating a newly deployed, still-unblacklisted host.

The domain remains active and under forensic review; PhishDestroy has flagged the IP and URL for proactive takedown outreach to hosting provider Wix and parent cloud provider Google Cloud. Organisations and users should block 34.144.206.118 and ledgr-startedapps.wixstudio.com at perimeter and DNS layers, avoid interaction, and report any credential exposure to incident-response teams. Remaining risk is medium due to active status and low AV coverage, but expected to drop once takedown completes within 24–48 hours.