us-desktop-ledgre[.]wixstudio[.]com

PhishDestroy identifies us-desktop-ledgre.wixstudio.com as an active generic phishing domain leveraging a spoofed desktop installer lure to harvest credentials or deliver malware. The domain shows no affiliation with legitimate software vendors and aligns with observed campaigns that impersonate system update prompts or application installers to trick users into executing malicious payloads or submitting sensitive credentials. No specific brand is mimicked in this sample, and no known drainer kit artifacts (e.g., MetaMask, walletconnect.js) were detected in available telemetry at this stage, suggesting a lightweight or newly deployed deception layer. Initial sandbox analysis reveals behavioral patterns consistent with credential harvesting via deceptive desktop shortcuts or batch scripts, though further behavioral unpacking is required for definitive classification. The domain is hosted on Wix’s Studio platform, which has been increasingly abused for low-cost, high-duration phishing campaigns due to its free tier and rapid deployment capabilities.

This domain exhibits the following technical indicators: a VirusTotal detection ratio of 3 out of 95 engines as of the latest scan, indicating a fresh or highly evasive payload. It resolves to IP address 34.144.206.118, a Google Cloud Platform (GCP) endpoint commonly used for dynamic, short-lived phishing infrastructure. SSL certification is provided by Let’s Encrypt, which remains a popular choice among threat actors due to its automated issuance and widespread trust in browsers. Domain registration details are obscured via Wix’s privacy protection, preventing discovery of the true registrant or creation timestamp. Google Safe Browsing (GSB) currently shows no listing, and public blocklists such as PhishTank or OpenPhish have not yet flagged this domain, giving it an unmonitored window of operation. These attributes suggest a low-profile, opportunistic campaign targeting less security-aware users.

Current status: us-desktop-ledgre.wixstudio.com remains actively resolving and serving content, with zero detections across endpoint and network security platforms. Response actions are underway to coordinate takedown with Wix Trust & Safety and Google Safe Browsing, but due to platform latency and regional routing, removal may take 48–72 hours. While the risk level is listed as 'under_investigation,' users interacting with this domain face immediate credential exposure or malware infection risk upon engagement. Security teams are advised to block the domain at DNS and firewall levels, inspect internal endpoints for outbound connections to 34.144.206.118, and warn users against downloading desktop installers from untrusted websites. Remaining risk: HIGH during the window before full deactivation, with potential for lateral movement if initial compromise occurs.