home-krrkancdn[.]wixstudio[.]com

This domain, home-krrkancdn.wixstudio.com, is identified as a credential theft operation designed to harvest login credentials, session tokens, and personally identifiable information. Analysis indicates the site likely employed fake login portals mimicking legitimate services, using social engineering tactics to trick users into submitting sensitive data. The infrastructure was configured to exfiltrate stolen credentials to attacker-controlled endpoints, posing significant risks of account takeovers, identity theft, and financial fraud for affected individuals. Evidence supporting this assessment includes detection by 9 out of 95 security vendors on VirusTotal, with the domain appearing on one security blocklist. The domain was registered through GoDaddy.com, LLC on June 12, 2026, an unusual future date suggesting possible domain spoofing or administrative anomalies. Infrastructure analysis reveals the domain resolved to IP address 34.144.206.118 and utilized technologies such as Wix, React, Google Cloud, and HTTP/3, which are commonly abused in phishing campaigns to lend false legitimacy. The SSL certificate issued by Let's Encrypt further aligns with patterns observed in credential theft operations, where encryption is used to evade detection. Users who visited home-krrkancdn.wixstudio.com should immediately revoke any active sessions associated with the site and reset passwords for accounts accessed during the exposure window. Enable multi-factor authentication on all critical accounts to mitigate unauthorized access. Monitor financial statements and credit reports for signs of fraudulent activity. If sensitive data such as payment details or government-issued identifiers were submitted, consider placing a fraud alert with credit bureaus. Organizations should update endpoint protection rules to block the domain and associated IP address, and conduct internal reviews to identify any compromised credentials linked to this campaign.