iiotrsert[.]wixstudio[.]com

This domain, iiotrsert.wixstudio.com, is identified as a credential theft phishing site targeting users through deceptive login interfaces. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, though the infrastructure aligns with common phishing tactics designed to harvest sensitive user credentials. The site leverages Wix Studio’s hosting environment, which is frequently exploited for rapid deployment of phishing pages due to its accessibility and low barrier to entry for threat actors.

Technical indicators reveal multiple high-risk attributes. The domain resolves to IP address 34.144.206.118, associated with Google Cloud infrastructure, and was registered through GoDaddy.com, LLC. Detection metrics show 16 out of 95 security vendors on VirusTotal flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain was created on April 30, 2026, an anomalous future date suggesting potential manipulation or misconfiguration. It appears on three security blocklists, including PhishDestroy and PhishingArmy, and is blocked by OISD. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process.

As of the latest assessment, the domain has been taken offline, likely due to hosting provider intervention or registrar enforcement. Despite its current inactive status, residual risk persists due to the potential for re-deployment under a different subdomain or domain. Users who may have interacted with this site are advised to reset credentials for any accounts accessed during the exposure window. Organizations should monitor for similar patterns, including subdomains on Wix Studio or other platform-as-a-service providers, and update blocklists to include the resolved IP and associated indicators of compromise.