en-apps-exedusweb[.]wixstudio[.]com

This domain is flagged as a high-risk generic phishing threat targeting users of educational services. Analysis indicates the infrastructure was designed to mimic legitimate academic portals, likely to harvest credentials or distribute malicious payloads under the guise of institutional communication. The domain currently returns a 404 error, suggesting it has been taken offline or relocated, but prior activity remains a significant concern for organizations in the education sector. Infrastructure analysis reveals the domain was registered through a major registrar and resolved to the IP address 34.144.206.118, hosted on cloud-based services. It appears on three security blocklists (PhishDestroy, PhishingArmy, OISD) and is flagged by 16 out of 95 security vendors on a malware analysis platform. The SSL certificate is issued by a widely trusted provider, which may have been exploited to lend false legitimacy. Technologies detected include Wix, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3, indicating a modern, scalable phishing framework. Mitigation steps should focus on proactive monitoring and user education. Organizations should block the domain and its associated IP (34.144.206.118) at the network perimeter and update endpoint protection rules to detect related indicators of compromise. Security teams are advised to audit logs for prior interactions with this domain, particularly in environments where educational services are accessed. Users should be trained to recognize phishing tactics, such as unexpected login prompts or urgent requests for credentials, and encouraged to report suspicious activity. Given the domain's prior use of cloud infrastructure, additional scrutiny of similar hosting patterns is recommended.