en-extension[.]wixstudio[.]com

en-extension.wixstudio.com is a recently active domain engaged in phishing operations targeting Chrome browser users through counterfeit extension installations. PhishDestroy analysis confirms this infrastructure is currently distributing deceptive browser add-ons designed to harvest user credentials and inject malicious scripts into web sessions. The threat is classified as ACTIVE with risk level set to UNDER_INVESTIGATION, indicating unconfirmed but credible evidence of malicious activity that requires immediate containment measures.

This domain exhibits several suspicious characteristics that warrant investigation. VirusTotal currently shows 3/95 detection engines flagging the domain despite confirmed malicious behaviors including fake extension downloads. The infrastructure resolves to IP address 34.144.206.118 which falls within Google Cloud's infrastructure range. The domain utilizes a legitimate Let's Encrypt SSL certificate, adding to its deceptive appearance. Notably absent from current threat intelligence feeds and blocklists, this presents a stealthy threat vector leveraging trusted certificate authorities and cloud hosting to bypass traditional security controls.

Mitigation requires immediate action targeting both the infrastructure and potential victims. Chrome users should avoid downloading any extensions from this domain and report any encountered instances to Google Safe Browsing via chrome://safe-browsing/report_phish. Network administrators should block DNS resolution for en-extension.wixstudio.com and the associated IP 34.144.206.118 at perimeter controls. Security teams should investigate internal logs for any traffic patterns involving these indicators and consider implementing browser extension allow-listing policies. Users who may have interacted with this domain should perform a full browser reset, change all saved credentials, and enable two-factor authentication on critical accounts.