appupholdapps[.]wixstudio[.]com

The domain appupholdapps.wixstudio.com has been identified as a high-risk phishing infrastructure specifically designed to mimic cryptocurrency login portals. Analysis indicates this is a fake login page intended to harvest credentials or facilitate unauthorized transactions. The domain is currently offline, though prior activity suggests it was actively targeting users in recent operations. Infrastructure analysis reveals this domain was flagged by 14 of 95 security vendors on VirusTotal, with Google Safe Browsing specifically categorizing it under SOCIAL_ENGINEERING. The domain was registered through GoDaddy.com, LLC on April 27, 2026, an anomalous future date that may indicate falsified registration details. It resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employs technologies including Wix, Envoy, React, and Google Cloud CDN. The SSL certificate is issued by Let’s Encrypt, a common but not exclusive indicator of legitimate domains. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0 out of 100, reinforcing its classification as malicious. Current status confirms the domain has been taken offline, likely due to detection and mitigation efforts. However, the underlying infrastructure remains a potential vector for future campaigns. Organizations and users are advised to block the domain and associated IP at the network level, monitor for related subdomains or redirects, and verify cryptocurrency login portals through official channels only. Security teams should treat any prior interaction with this domain as a potential credential compromise and initiate password resets for affected accounts. The anomalous registration date and use of cloud hosting suggest the threat actor may reuse similar patterns in future phishing operations.