connectportal[.]wixstudio[.]com

PhishDestroy identifies connectportal.wixstudio.com as an active credential-harvesting domain impersonating a legitimate WIX portal. This domain is currently classified under generic phishing with an under_investigation risk status, indicating active abuse potential against unsuspecting users seeking WIX services. The threat actor leverages the WIX platform to host a deceptive login interface, aiming to trick users into submitting their credentials under false pretenses.

This domain was flagged by 5 of 95 VirusTotal vendors, operates with a valid Let's Encrypt SSL certificate, and resolves to IP 34.144.206.118. While no blocklist count or registrar details are publicly available yet, the absence of detections on VirusTotal suggests this threat may be newly deployed or employs evasion techniques to bypass initial scanning. The use of a legitimate hosting provider (WIX) complicates detection efforts, requiring advanced behavioral analysis to uncover malicious intent.

Current status remains active, with no confirmed takedowns as of this report. Users are strongly advised to avoid interacting with connectportal.wixstudio.com and verify any WIX-related communications through official channels. If accidental exposure occurs, immediately change passwords and enable multi-factor authentication on all accounts. Security teams should monitor IP 34.144.206.118 and report findings to threat intelligence platforms to improve detection coverage. This case highlights the growing trend of abusing trusted platforms for phishing campaigns.