logon-applived[.]wixstudio[.]com

This domain is flagged as a high-risk fake login portal designed to harvest credentials through deceptive authentication interfaces. Analysis indicates the infrastructure was specifically crafted to impersonate legitimate login pages, likely targeting users of cloud-based or enterprise applications. The threat type aligns with credential theft campaigns, where victims are tricked into entering sensitive information into fraudulent forms. Infrastructure analysis reveals the domain logon-applived.wixstudio.com resolves to IP address 34.144.206.118 and was registered on May 02, 2026, through GoDaddy.com, LLC. Security vendors on VirusTotal flagged the domain at a detection rate of 13/95, while Gridinsoft assigned a trust score of 0/100. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. SSL certification is provided by Let's Encrypt, and the page currently returns a 404 error, suggesting it has been taken offline or relocated. Technologies detected include Wix, Envoy, React, Google Cloud, Lodash, HSTS, Google Cloud CDN, and HTTP/3, indicating a sophisticated hosting environment. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address (34.144.206.118) at the network perimeter. Security teams should conduct a retrospective analysis of DNS logs to identify any prior connections to the domain. End-user education should emphasize the risks of fake login portals, particularly those hosted on subdomains of legitimate platforms. Organizations are advised to enforce multi-factor authentication (MFA) to mitigate the impact of credential theft. Monitoring for similar domains registered through GoDaddy or hosted on Google Cloud infrastructure may help preempt future threats.