blowfin-lgn[.]wixstudio[.]com

This subdomain, blowfin-lgn.wixstudio.com, has been identified as a credential theft operation designed to harvest login credentials under the guise of the Wix platform. Analysis indicates the site employed a 404 error page as a decoy, likely to evade detection while capturing sensitive user data through embedded malicious forms or redirects. No direct evidence of a cryptocurrency drainer kit was observed, but the domain’s infrastructure aligns with known credential harvesting tactics targeting web hosting and CMS platforms. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on June 12, 2026, an anomalous creation date suggesting potential domain spoofing or typosquatting. The subdomain resolved to the IP address 34.144.206.118, hosted on a cloud provider’s infrastructure. Detection metrics include a VirusTotal score of 3/95 security vendors flagging the domain, with one confirmed blocklist entry (PhishDestroy). The SSL certificate was issued by Let’s Encrypt, a common tactic to lend legitimacy to malicious sites. No Google Safe Browsing (GSB) records were identified at the time of analysis. The domain is currently offline, likely due to takedown actions or cessation of the campaign. However, residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations are advised to monitor for unauthorized access attempts linked to credentials potentially compromised through this operation. Network defenders should block the IP address 34.144.206.118 and audit logs for connections to blowfin-lgn.wixstudio.com to mitigate further exposure.