starts-ledzercom[.]wixstudio[.]com

This domain, starts-ledzercom.wixstudio.com, is identified as a credential phishing endpoint targeting users through deceptive login prompts or data submission forms. Analysis indicates no direct brand impersonation, but the infrastructure aligns with generic phishing campaigns designed to harvest credentials or sensitive information. No specific drainer kit signatures were detected, though the domain’s hosting and technical setup suggest automated or template-based deployment typical of phishing operations. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 13 out of 95 security vendors on VirusTotal, registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. The domain was created on April 27, 2026, an anomalous future date likely indicative of falsified registration data. It is currently blocked by three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The domain employs a Let’s Encrypt SSL certificate, a common tactic to appear legitimate, and is hosted on Google Cloud infrastructure with HTTP/3 and Google Cloud CDN technologies detected. The domain is currently offline, likely due to takedown actions or abandonment by the threat actor. Despite its inactive status, residual risk remains due to the potential for re-registration or migration to alternative infrastructure. Organizations are advised to maintain blocklist entries for this domain and monitor for re-emergence under similar naming conventions or hosting patterns. Network defenders should inspect logs for prior connections to 34.144.206.118 and review endpoint activity for interactions with the domain before its takedown.