nav-kaimly-io[.]wixstudio[.]com

This domain, nav-kaimly-io.wixstudio.com, is identified as a credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates the site mimics legitimate authentication interfaces to capture usernames, passwords, and potentially multi-factor authentication codes, redirecting victims to fraudulent data collection endpoints. The infrastructure is designed to evade casual detection, leveraging subdomain obfuscation and dynamic content delivery to bypass basic security filters.

Infrastructure analysis reveals the domain was registered on December 17, 2016, through a major registrar, and currently resolves to the IP address 34.144.206.118. It is flagged by 4 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and is secured with a Let's Encrypt SSL certificate, which is commonly exploited to lend false legitimacy to phishing pages.

Users who visited nav-kaimly-io.wixstudio.com should immediately revoke any credentials entered on the site, particularly if reused across other platforms. Monitor accounts for unauthorized access or transactions, and enable multi-factor authentication where available. Security teams should update blocklists to include this domain and its associated IP address, and conduct internal investigations to identify any compromised credentials linked to this campaign. The domain is currently offline, but threat actors may reactivate it or migrate to similar infrastructure.