appstart-official[.]wixstudio[.]com

This domain, appstart-official.wixstudio.com, is identified as a credential theft operation designed to impersonate the Wix platform. The site presents itself as a legitimate Wix Studio page but is engineered to capture user login credentials through deceptive input forms. As of the latest assessment, the domain has been taken offline, though prior activity indicates a targeted campaign against Wix users. Analysis indicates the domain was registered on April 28, 2026, through GoDaddy.com, LLC, a registrar frequently exploited for malicious infrastructure. It resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, which is commonly leveraged for both legitimate and fraudulent purposes. The domain appears on one security blocklist and is flagged by 12 of 95 security vendors on VirusTotal, signaling moderate detection coverage. The SSL certificate is issued by Let's Encrypt, a certificate authority often abused due to its free and automated issuance process. Technologies detected include Wix, React, Google Cloud, Lodash, HSTS, and Google Cloud CDN, suggesting an attempt to mimic authentic Wix Studio pages. The Gridinsoft trust score for this domain is 0/100, reinforcing its classification as malicious. The domain is currently offline, though the infrastructure remains a potential risk for future abuse. Organizations and users are advised to block the domain and its associated IP address (34.144.206.118) at the network level to prevent accidental access. Security teams should monitor for similar patterns, such as newly registered domains under Wix or other SaaS branding, particularly those using free SSL certificates and cloud hosting. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Proactive scanning for related indicators of compromise is recommended to mitigate residual risk.