logon-maskmta[.]wixstudio[.]com

This domain, logon-maskmta.wixstudio.com, is identified as a credential theft operation impersonating Microsoft login portals. Analysis indicates the infrastructure was designed to harvest user account credentials by mimicking legitimate authentication pages, likely targeting corporate or personal Microsoft 365 accounts. The use of a subdomain under wixstudio.com suggests an attempt to exploit the reputation of a legitimate website builder platform to evade initial suspicion. Infrastructure analysis reveals the domain was registered on April 23, 2026, through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. The domain is flagged by 16 out of 95 security vendors on VirusTotal, and appears on at least one security blocklist. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The page currently returns a 404 error, indicating the phishing content has been removed or the domain has been taken offline, though this does not eliminate residual risk. Users who visited logon-maskmta.wixstudio.com should assume their credentials may have been compromised. Immediate actions include resetting passwords for any accounts accessed through the site, enabling multi-factor authentication where available, and monitoring associated accounts for unauthorized activity. System scans for malware are recommended, as credential theft sites sometimes deploy additional payloads. Organizations should review logs for connections to 34.144.206.118 and the domain itself, and consider blocking both at the network level as a precautionary measure.