open-legr-live[.]wixstudio[.]com

This domain, open-legr-live.wixstudio.com, is flagged as a high-risk phishing site designed to mimic a legitimate login portal. Analysis indicates no direct association with a specific brand, but the infrastructure suggests a generic credential-harvesting campaign. The threat type is classified as generic_phishing, likely targeting users through deceptive login prompts to capture sensitive credentials such as usernames, passwords, or multi-factor authentication codes. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 34.144.206.118 and was registered through GoDaddy.com, LLC on April 07, 2026. It holds a Let's Encrypt SSL certificate, which, while common for legitimate sites, is frequently exploited by threat actors to lend false credibility. The domain is detected by 16 out of 95 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. No Google Safe Browsing (GSB) hits were reported at the time of analysis. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for future malicious activity. Response actions should include monitoring for DNS reactivation, IP reassignment, or SSL certificate reissuance. Organizations are advised to block the domain and its resolving IP at the network perimeter, update endpoint protection rules, and conduct retrospective log analysis to identify any prior interactions with this infrastructure. Remaining risk is mitigated but not eliminated, as the domain's registration and underlying hosting resources remain under adversary control.