appwebrabby[.]wixstudio[.]com

PhishDestroy identifies appwebrabby.wixstudio.com as an active credential theft phishing domain currently under investigation. This Wix-hosted subdomain is suspected of impersonating a legitimate web application to harvest user credentials under the guise of a login portal. The threat actor has leveraged the WixStudio platform to create a deceptive interface, potentially targeting users with fake authentication requests. As of the latest telemetry, the domain remains operational and has not been neutralized by takedown efforts.

This domain was flagged by 0 of 95 VirusTotal vendors, indicating it has evaded detection by major security engines. The domain resolves to IP address 34.144.206.118 and operates under a Let's Encrypt SSL certificate to enhance its legitimacy. The WixStudio subdomain suggests recent deployment, though historical WHOIS data indicates the underlying domain structure was registered with unknown specifics. There are currently no reported entries in blocklists such as PhishTank or OpenPhish. Trust scores from threat intelligence platforms remain inconclusive due to the lack of detections, but the domain's active status and SSL certificate warrant immediate scrutiny.

PhishDestroy advises users to avoid interacting with appwebrabby.wixstudio.com or submitting any credentials. Security teams should block the domain at the network perimeter using the IP address 34.144.206.118 and monitor outbound connections for callback attempts. If credentials were entered, users must rotate passwords immediately and enable multi-factor authentication on all associated accounts. Reporting this domain to PhishTank or your organization’s threat intelligence team will aid in its eventual blacklisting. Exercise heightened caution with Wix-hosted subdomains, especially those requesting login credentials without verifiable context.