connectwebpage[.]wixstudio[.]com

This domain, connectwebpage.wixstudio.com, is identified as a high-risk credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the domain leverages Wix Studio infrastructure, a platform typically used for legitimate web hosting, to host fraudulent pages designed to capture sensitive authentication credentials. No specific brand impersonation or drainer kit signatures were detected in the available telemetry, though the generic phishing classification suggests broad targeting of login portals across multiple services. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. Detection metrics show 15 out of 95 security vendors on VirusTotal flagged the domain as malicious, with a Gridinsoft trust score of 0/100. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The SSL certificate is issued by Let's Encrypt, a common practice among both legitimate and malicious sites to enable HTTPS. Technologies detected include Wix, React, Google Cloud CDN, and HTTP/3, indicating the use of modern web frameworks and content delivery networks to enhance the phishing page's appearance and performance. As of the latest assessment, the domain has been taken offline, and the page returns a 404 error consistent with Wix Studio's default error page. This suggests mitigation efforts, such as takedown requests or platform enforcement, have been effective in disrupting the phishing campaign. However, residual risk remains due to the domain's prior use in credential harvesting operations. Users who may have interacted with the domain are advised to reset passwords for any accounts accessed during the exposure window and enable multi-factor authentication where available. Organizations should monitor for unauthorized access attempts linked to credentials potentially compromised through this campaign.