eng-exchange[.]wixstudio[.]com

PhishDestroy identifies eng-exchange.wixstudio.com as a domain actively engaged in brand impersonation, specifically targeting the GMX email service. The domain is currently flagged as active and under investigation due to its malicious intent to deceive users by mimicking GMX’s branding and services. This impersonation could lead to credential theft, financial fraud, or unauthorized account access if users interact with the fraudulent site.

Technical analysis of eng-exchange.wixstudio.com reveals a concerning lack of detection, with 0 out of 95 VirusTotal vendors flagging it as malicious at the time of analysis. The domain resolves to IP address 34.144.206.118 and utilizes a Let's Encrypt SSL certificate to appear legitimate. Notably, this domain is hosted on Wix’s infrastructure (wixstudio.com), which may be leveraged to evade traditional blocklists due to the platform’s widespread trust. Additional investigation into the domain’s metadata, such as its creation date and registrar, is recommended to assess its recency and potential ties to known threat actors.

PhishDestroy assesses the risk associated with eng-exchange.wixstudio.com as active and under further evaluation. Given the domain’s impersonation of GMX, users are strongly advised to avoid interacting with this site or providing any credentials. Organizations should consider blocking the domain at the network level using the identified IP address (34.144.206.118) and monitoring for any internal connections to the domain. Additionally, users who may have already engaged with the domain should immediately reset their GMX account passwords and enable multi-factor authentication to mitigate potential compromise. Security teams are encouraged to report this domain to threat intelligence platforms and update firewall rules accordingly.