en-meteor-apps[.]wixstudio[.]com

This domain, en-meteor-apps.wixstudio.com, is identified as a credential phishing infrastructure component. Analysis indicates no direct brand impersonation or known drainer kit association, suggesting a generic credential harvesting operation. The domain leverages a subdomain of a legitimate website builder platform, a common tactic to evade initial scrutiny and exploit trust in established services. No specific phishing campaign or targeted brand was conclusively linked to this infrastructure during investigation. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 34.144.206.118, hosted on a cloud provider network. It was registered through a major domain registrar on December 17, 2016, indicating an aged domain potentially repurposed for malicious activity. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. VirusTotal detection shows 4 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists: PhishDestroy, PhishingArmy, and OISD. Gridinsoft trust score for this domain is 0/100, further corroborating its malicious classification. No Google Safe Browsing (GSB) listing was confirmed at the time of analysis. Current status indicates the domain has been taken offline, likely in response to detection and reporting. However, the risk level remains elevated due to the domain's age and prior malicious use. Organizations should ensure this domain and its associated IP (34.144.206.118) are blocked at the network perimeter. Security teams are advised to monitor for any re-emergence of this infrastructure or similar subdomain patterns on the same platform. End users should be educated on recognizing phishing attempts, particularly those leveraging subdomains of legitimate services. Historical logs should be reviewed for any prior connections to this domain or IP address to assess potential compromise.