usapp-bridge[.]wixstudio[.]com

PhishDestroy has flagged usapp-bridge.wixstudio.com as a live PayPal-themed phishing page running on WixStudio’s platform. The site mimics official PayPal branding to harvest login credentials and payment details from unsuspecting users. Traffic is routed through IP 34.144.206.118, a cloud-hosted address controlled by the threat actor, and secured with a Let’s Encrypt SSL certificate to appear legitimate. This domain was flagged under seed 3376dc and has yet to be detected by antivirus engines according to VirusTotal, showing 0 detections out of 95 scanners. The domain resolves to a dedicated Google Cloud IP (34.144.206.118) and leverages WixStudio’s no-code builder to rapidly deploy new phishing pages while evading takedown efforts. Despite hosting on a reputable CDN, the site’s content actively impersonates PayPal to deceive visitors. The domain is not currently listed on major blocklists, allowing it to persist in circulation. Creation date and registrar details remain undisclosed due to Wix’s privacy protections, further complicating attribution. Users who visited usapp-bridge.wixstudio.com should immediately check bank statements for unauthorized transactions and revoke any saved payment methods linked to compromised accounts. Do not enter login credentials or payment details on this site. If credentials were submitted, change passwords immediately and enable two-factor authentication. Report the domain to PayPal’s fraud team and local cybercrime units. Clear browser cache and cookies to remove tracking scripts. Monitor accounts for 30 days for signs of fraudulent activity.