apps-exadsweb[.]wixstudio[.]com

This domain is flagged as an elevated-risk phishing infrastructure targeting users of digital advertising platforms. Analysis indicates the site was designed to mimic legitimate ad service portals, likely to harvest credentials, payment details, or deploy malicious payloads under the guise of ad campaign management or analytics. The threat type aligns with generic phishing but exhibits characteristics of targeted credential theft against advertising professionals or businesses. Infrastructure analysis reveals the domain was registered on May 01, 2026, through GoDaddy.com, LLC, a common registrar for both legitimate and malicious domains. It resolves to IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employs technologies including Wix, React, Google Cloud CDN, and HTTP/3. The SSL certificate is issued by Let's Encrypt, a frequent choice for phishing sites due to its free and automated issuance. The domain is currently offline but was detected by 3 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on five security blocklists: MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD. The page title, '404 Error: Page Not Found | Wix Studio,' suggests either a takedown or a cloaking mechanism to evade detection. Mitigation against this threat involves several technical and procedural controls. Network-level protections should block the domain and its resolving IP (34.144.206.118) at firewalls and DNS resolvers, leveraging blocklist integrations from PhishDestroy, PhishingArmy, SEAL, and OISD. Organizations should monitor for internal access attempts to the domain or IP, particularly from teams involved in digital advertising. Endpoint detection rules should flag any processes attempting to connect to the domain or its infrastructure. User awareness training should emphasize the risks of credential submission on ad-related portals, especially those hosted on subdomains of website builders like Wix. Given the domain's use of Google Cloud, security teams should also review logs for any connections to 34.144.206.118 or related Google Cloud IP ranges, as attackers may reuse infrastructure across campaigns.