homepage-veldroome[.]wixstudio[.]com

The domain homepage-veldroome.wixstudio.com has been identified as a fake login phishing portal designed to harvest user credentials. Analysis indicates the site impersonated legitimate authentication pages to deceive visitors into submitting sensitive login information. As of the latest verification, the domain has been taken offline, though it remains a documented threat. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on December 17, 2016, and resolved to the IP address 34.144.206.118. It was flagged by 5 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0 out of 100. The domain appeared on three distinct security blocklists, including entries from PhishDestroy, PhishingArmy, and OISD. The SSL certificate was issued by Let's Encrypt, a common characteristic observed in both legitimate and malicious domains. Although the domain is currently offline, residual risk persists due to potential reuse of the infrastructure or similar tactics by threat actors. Organizations are advised to block the domain and associated IP address (34.144.206.118) at the perimeter level. Security teams should monitor for credential theft attempts linked to this campaign and conduct internal audits for compromised accounts. End-users should be educated on recognizing phishing indicators, particularly those mimicking login portals.