eng-io-gate[.]wixstudio[.]com

PhishDestroy identifies eng-io-gate.wixstudio.com as an active credential theft phishing domain under investigation. The domain leverages a Wix Studio subdomain to host a deceptive interface designed to harvest user credentials under false pretenses. Current evidence indicates the infrastructure remains operational, with threat actors likely distributing links via social engineering campaigns to compromise account access. Users are advised against interacting with this domain and to verify URLs before submitting sensitive information.

This domain was flagged by 3 of 95 VirusTotal vendors, operates on IP 34.144.206.118, and utilizes a Let's Encrypt SSL certificate to establish false legitimacy. The domain resolves to a Google Cloud Platform (GCP) infrastructure, as identified by the IP geolocation. While the domain's creation date and registrar information remain undisclosed due to Wix’s privacy protections, the absence of detections suggests a recently deployed or undetected campaign. Trust scores from threat intelligence platforms such as Google Safe Browsing and PhishTank have not been assigned, leaving users vulnerable without proactive blocking mechanisms. The domain’s reliance on obfuscation via a reputable subdomain platform highlights the evolving tactics used by credential theft actors to bypass traditional security filters.

Current status remains active, with no confirmed takedown or remediation by hosting providers or security vendors. PhishDestroy recommends immediate blocking of the domain and associated IP at the network level to prevent further access. Users should remain vigilant for unsolicited messages containing links to this domain and verify the authenticity of login portals independently. Additionally, enabling multi-factor authentication (MFA) on all critical accounts serves as a critical mitigation against credential theft, even if login credentials are compromised. Security teams are urged to monitor for related infrastructure, including additional Wix subdomains or domains resolving to the same IP, as part of a broader threat hunting effort.