webperforma[.]wixstudio[.]com

This domain is flagged as a high-risk credential theft operation targeting users through deceptive login portals. Analysis indicates the infrastructure was designed to harvest account credentials, likely for financial or corporate exploitation, before being taken offline. The domain exhibits no legitimate content, reinforcing its malicious intent. Infrastructure analysis reveals the domain was registered on May 02, 2026, through GoDaddy.com, LLC, an uncommon future date suggesting potential typosquatting or preemptive registration abuse. It resolves to IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employs technologies including Wix, React, Google Cloud CDN, and HTTP/3. Security vendors on VirusTotal flagged the domain as malicious, with 13 out of 95 detections. The domain appears on three blocklists: PhishDestroy, PhishingArmy, and OISD. Additional indicators include a Gridinsoft trust score of 0/100 and a Let's Encrypt SSL certificate, which, while valid, is frequently exploited by threat actors to lend false legitimacy. The page title, '404 Error: Page Not Found | Wix Studio,' suggests the phishing content was removed or relocated, though residual artifacts remain detectable. Mitigation for credential theft threats involves immediate action from affected parties. Users who interacted with the domain should reset passwords for all accounts accessed during the exposure window, prioritizing financial, email, and corporate systems. Organizations should review logs for connections to 34.144.206.118 and the domain itself, correlating with authentication attempts or anomalous login activity. Security teams are advised to block the domain and IP at the perimeter, update endpoint protection rules, and monitor for follow-up campaigns leveraging similar infrastructure. Given the use of cloud hosting and CDN technologies, defenders should also assess whether additional subdomains or related infrastructure remain active under the same registrar or hosting provider.