webcatalog-io[.]wixstudio[.]com

This domain, webcatalog-io.wixstudio.com, is identified as a credential theft operation targeting users through deceptive login prompts. Currently, the domain is offline, displaying a 404 error page hosted on Wix Studio infrastructure. Analysis indicates the page was designed to harvest account credentials by impersonating legitimate services, though no specific brand impersonation was confirmed in the available metadata. Infrastructure analysis reveals the domain was flagged by 11 of 95 security vendors on VirusTotal, indicating broad detection of malicious intent. It was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The domain appears on one security blocklist, and Gridinsoft assigned it a trust score of 0 out of 100. Detected technologies include Wix, Envoy, React, Lodash, and Google Cloud CDN, with HSTS and HTTP/3 enabled. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. The domain is currently offline, but historical activity and detection metrics suggest it was part of a larger credential theft campaign. Users who may have interacted with this domain are advised to reset passwords for any accounts accessed during the exposure window. Organizations should update blocklists to include this domain and its associated IP address. Security teams are recommended to monitor for related indicators, including subdomains or similar naming patterns under the wixstudio.com namespace, which may indicate persistent threat actor infrastructure.