atonicio[.]wixstudio[.]com

The domain atonicio.wixstudio.com has been identified as a credential harvesting phishing resource targeting unspecified brands. Analysis indicates the domain is currently offline, though it previously hosted content designed to deceive users into submitting authentication credentials. No specific brand impersonation was confirmed from available metadata, though the site structure and historical detection patterns align with credential theft operations commonly associated with phishing campaigns. Infrastructure analysis reveals the domain resolved to the IP address 34.144.206.118 and was registered through GoDaddy.com, LLC, with a creation date of April 26, 2026. Security vendors flagged the domain as malicious, with 13 of 95 VirusTotal engines detecting it as a phishing threat. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The SSL certificate was issued by Let's Encrypt, a common practice among both legitimate and malicious sites to enable HTTPS connections. Gridinsoft assigned a trust score of 0 out of 100, further corroborating the domain's high-risk classification. The 404 error page title, '404 Error: Page Not Found | Wix Studio,' suggests the domain was hosted on a platform that provides website-building services, which are occasionally abused for phishing due to their accessibility and low cost. At present, the domain is offline, reducing immediate risk to end users. However, organizations should remain vigilant, as phishing infrastructure often exhibits transient behavior. Network administrators are advised to block the domain and its associated IP address (34.144.206.118) at the perimeter level to prevent potential future access. Endpoint protection systems should be updated to include this domain in phishing detection rules. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the suspected exposure window. Monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to identify potential follow-up campaigns.