user-bridges[.]wixstudio[.]com

PhishDestroy’s ongoing investigation has identified user-bridges.wixstudio.com as a credential theft domain actively hosting a fraudulent login interface. The domain is currently classified as ACTIVE and is under active analysis for its role in harvesting user credentials under false pretenses. This infrastructure is suspected to target unsuspecting users through deceptive landing pages designed to mimic legitimate login portals. The threat actor behind this domain is likely engaged in large-scale credential theft for subsequent account takeovers, financial fraud, or identity compromise. All users and security teams are advised to treat this domain as hostile and avoid any interaction.

This domain was flagged by 0 of 95 VirusTotal vendors as of the latest scan, indicating it has evaded detection by most antivirus engines and sandboxing tools. The domain resolves to IP address 34.144.206.118, which is hosted on infrastructure associated with cloud service providers known to host malicious content. The domain uses a Let's Encrypt SSL certificate to enhance its appearance of legitimacy, increasing the likelihood of user trust. The current blocklist count from reputable threat intelligence sources stands at 3, reflecting its relatively new emergence in the threat landscape. Trust scores for the domain and its associated IP are currently assessed as low, with an overall trust score of 12/100, further validating its malicious intent.

As this investigation remains active, security professionals are urged to block all traffic to and from user-bridges.wixstudio.com at both the network and endpoint levels. Domain-based security policies should be updated to include this domain, and users should be notified to avoid accessing the site or entering any credentials. Additionally, organizations are encouraged to monitor for any downstream compromise stemming from credentials harvested via this domain. PhishDestroy will continue to monitor this domain and will provide further updates as additional intelligence is gathered. Immediate action is strongly advised to mitigate the risk of credential theft and potential follow-on attacks.