usen-desktop[.]wixstudio[.]com

This domain is flagged as a high-risk credential theft operation targeting users through deceptive login portals. Analysis indicates the infrastructure was designed to harvest authentication credentials, likely for unauthorized account access or financial fraud. The domain exhibits characteristics consistent with targeted phishing campaigns, including the use of legitimate-looking subdomains to evade detection and increase victim trust. Infrastructure analysis reveals the domain was registered on May 02, 2026, through GoDaddy.com, LLC, an uncommonly future-dated creation that may indicate an attempt to bypass reputation-based filters. It resolves to IP address 34.144.206.118 and is currently offline, though historical data shows it was active in malicious campaigns. The domain is detected by 10 out of 95 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy and PhishingArmy. Gridinsoft assigns a trust score of 0/100, further confirming its malicious classification. The SSL certificate is issued by Let's Encrypt, a common tactic to mimic legitimate encryption while conducting fraudulent activities. The page title, '404 Error: Page Not Found | Wix Studio,' suggests either a takedown or an attempt to mask the true nature of the content from automated scanners. Mitigation steps for credential theft threats include immediate blocking of the domain and its associated IP (34.144.206.118) at the network perimeter. Organizations should conduct a retrospective analysis of logs to identify any prior connections to this domain or IP, particularly from endpoints that may have interacted with login portals. Users who accessed the domain should be instructed to reset credentials for any accounts entered, especially if multi-factor authentication was not enabled. Security teams should monitor for similar subdomain patterns (e.g., *wixstudio.com) and implement domain reputation checks to prevent future exposure. Additionally, endpoint detection and response (EDR) tools should be configured to alert on processes attempting to resolve or connect to newly registered or low-reputation domains.