enus-appstart[.]wixstudio[.]com

This domain, enus-appstart.wixstudio.com, is currently under investigation for credential theft activity. Analysis indicates no direct association with a specific brand or drainer kit, but the infrastructure aligns with typical phishing deployments targeting user login credentials. The site was hosted on a Wix Studio subdomain, a common tactic to exploit legitimate platform trust while evading initial scrutiny. Infrastructure analysis reveals critical technical indicators: the domain has a VirusTotal detection score of 0/95, suggesting it has not yet been widely flagged by security vendors. It was registered through GoDaddy.com, LLC on May 02, 2026, an anomalous future date that may indicate registry manipulation or data entry error. The domain resolves to IP address 34.144.206.118, associated with Google Cloud infrastructure, and appears on 1 security blocklist. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated nature. Technologies detected include Wix, Envoy, React, Google Cloud CDN, and HTTP/3, further suggesting an attempt to mimic legitimate web properties. The domain is currently offline, likely taken down following detection by security systems. While the immediate threat appears mitigated, residual risk remains due to the anomalous registration date and unresolved infrastructure patterns. Users who may have interacted with this domain are advised to monitor accounts for unauthorized access and reset credentials as a precaution. Organizations should review logs for connections to 34.144.206.118 and the domain itself to assess potential exposure.