nav-itustcptal[.]wixstudio[.]com

PhishDestroy identifies nav-itustcptal.wixstudio.com as a live credential theft page actively harvesting user login details. The page mimics a legitimate service, tricking visitors into submitting credentials that are immediately exfiltrated to attacker-controlled servers. Security researchers note that attackers frequently abuse Wix subdomains to host phishing portals, leveraging the platform’s trusted domain reputation to bypass email filters and browser warnings. This particular site resolves to a Google Cloud IP (34.144.206.118) and is secured with a Let’s Encrypt SSL certificate, further enhancing its deceptive appearance.

This domain was flagged with 4/95 detections on VirusTotal at the time of analysis, indicating that common scanning engines had not yet blacklisted the URL. The site shows no signs of prior abuse listings, suggesting a recently deployed campaign with a clean reputation profile. While exact creation dates and registrar details remain unverified, the domain’s current configuration and operational status confirm active credential harvesting activities. Based on observed infrastructure and behavior patterns, the credential theft page poses a high risk to individuals or organizations that interact with it, potentially leading to unauthorized access, data breaches, or financial loss.

If you visited nav-itustcptal.wixstudio.com, immediately change any credentials entered on the site and enable multi-factor authentication where available. Scan your device using updated antivirus software to detect any installed malware. Report the domain to your IT team or internet security provider and avoid clicking any links or downloading files from similar Wix subdomains. Stay alert: threat actors continuously repurpose legitimate services like Wix, GitHub Pages, or Google Sites to host phishing pages, making direct domain checks essential before submitting sensitive information.