asset-download[.]wixstudio[.]com

asset-download.wixstudio.com has been identified by PhishDestroy analysts as an active credential-harvesting portal posing as a legitimate download asset page. The infrastructure is currently live and is being used to deceive end-users into surrendering sensitive account credentials, primarily targeting business and consumer login pages. The site is not a passive lure; it is actively collecting input and transmitting captured data to attacker-controlled servers under the guise of a legitimate file-download workflow. Initial infection vectors appear to be spear-phishing emails and spoofed intranet portals that redirect victims to the fraudulent WixStudio subdomain. Given the absence of endpoint controls on the site, exfiltration occurs in real time, exposing victims to immediate account takeover and follow-on financial or identity fraud. The domain asset-download.wixstudio.com resolves to IP address 34.144.206.118 via a Let’s Encrypt SSL certificate issued for the exact domain name. VirusTotal currently shows zero detections out of 95 engines, indicating that signature-based defenses have not yet flagged the payload. Historical WHOIS data indicates the domain was recently created and is served from a Google Cloud Platform instance, pointing to a rapid deployment designed to evade early detection. The subdomain prefix asset-download is intentionally chosen to masquerade as a legitimate asset repository, while the wixstudio.com parent namespace adds a veneer of credibility borrowed from the legitimate Wix Studio platform. All available threat intelligence feeds remain silent, suggesting the campaign is still in its initial ramp-up phase. To neutralize this threat, users should block inbound connections to 34.144.206.118 at the network perimeter and immediately add asset-download.wixstudio.com to browser and DNS blocklists. Security teams should deploy browser isolation for any employee clicking links that resolve to this IP and scan endpoint logs for POST requests to the path /submit containing form data labeled username or password. Organizations should also reset credentials for any accounts that may have been entered on this rogue portal, enable multi-factor authentication across all exposed services, and issue user advisories warning against visiting any wixstudio.com subdomain that requests login credentials outside the official platform login page at wix.com/login. Continuous monitoring of newly created subdomains under wixstudio.com is recommended to preempt further credential-harvesting sites leveraging the same infrastructure.