open-legrlive[.]wixstudio[.]com

This domain is flagged as an elevated-risk credential harvesting phishing site targeting user authentication credentials. Analysis indicates the infrastructure was designed to mimic legitimate login portals, a common tactic in account takeover campaigns. The domain is currently offline, but prior activity suggests it was actively used for phishing operations. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolved to IP address 34.144.206.118. Technologies detected include Wix, React, Google Cloud, and Google Cloud CDN, with HTTP/3 support and a Let's Encrypt SSL certificate. The page title displayed a 404 error, likely due to takedown or evasion attempts. Security vendors flagged the domain in 2 out of 95 detection engines on VirusTotal, and it appears on one security blocklist. The domain was blocked by PhishDestroy prior to being taken offline. Mitigation steps for credential harvesting phishing threats include implementing multi-factor authentication (MFA) for all accounts, particularly those with access to sensitive systems. Network administrators should block the domain and its resolving IP (34.144.206.118) at the perimeter firewall and DNS level. End-users should be trained to recognize phishing indicators, such as unexpected login prompts, mismatched URLs, and generic error pages. Organizations should monitor for unauthorized access attempts using credentials that may have been exposed through this campaign. If the domain was accessed prior to takedown, password resets and session invalidation are recommended for potentially compromised accounts.