# PhishDestroy threat dossier — sitesuiteapp.wixstudio.com ================================================================ Fetched: 2026-05-09 21:18:58 UTC Canonical: https://phishdestroy.io/domain/sitesuiteapp.wixstudio.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 97/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Sui ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Cluster25, CRDF, Gridinsoft, Webroot ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 34.144.206.118 (US, Kansas City) ASN: AS396982 Google LLC Hosting org: Google Cloud Registrar: GoDaddy.com, LLC Nameservers: ["dns1.p08.nsone.net", "dns2.p08.nsone.net", "dns3.p08.nsone.net", "dns4.p08.nsone.net"] Registered: 2026-05-04 Page title: 404 Error: Page Not Found | Wix Studio HTTP response: 404 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-07-29 Status: INVALID chain Fingerprint: c2c2f0e645b35156ce5cf39339fbe5ae5ffb02446fe2aeb96da83b6fe9b20ad4 Subject Alternative Names (related infrastructure — often same operator): - wixstudio.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-04 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-04 19:43:00 UTC (by PhishDestroy tracker) Last verified: 2026-05-09 07:29:59 UTC Neutralised: 2026-05-05 01:52:06 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019df3dc-6634-74e2-8011-6dcfdc50e303/ Wayback Machine: https://web.archive.org/web/*/sitesuiteapp.wixstudio.com crt.sh CT logs: https://crt.sh/?q=%25.sitesuiteapp.wixstudio.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=sitesuiteapp.wixstudio.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/sitesuiteapp.wixstudio.com URLhaus: https://urlhaus.abuse.ch/host/sitesuiteapp.wixstudio.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-04 19:44:52 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies sitesuiteapp.wixstudio.com as an active generic phishing domain masquerading as an application suite portal. The site leverages the Wix Studio platform to host a convincing replica of a software interface, tricking users into submitting login credentials or sensitive data. This campaign is still live, hosted at IP address 34.144.206.118 and secured via a Let's Encrypt SSL certificate—a common tactic to appear legitimate and evade browser warnings. The absence of detections on VirusTotal (0/95 engines) suggests this campaign is either newly deployed or deliberately avoiding signature-based detection, making it particularly dangerous for unsuspecting users. This threat was flagged using seed identifier af0d39 and is currently under investigation. The domain resolves to a single IP address (34.144.206.118) and uses a publicly trusted SSL certificate issued by Let's Encrypt, which does not inherently indicate malicious intent but is often exploited in phishing campaigns to build trust. With zero detections on VirusTotal, the site remains undetected by traditional antivirus engines as of the time of flagging. The combination of a legitimate hosting platform (Wix Studio), a clean IP reputation, and a trusted SSL certificate creates a deceptive surface designed to bypass basic security controls. The domain's recent creation and active status indicate a rapidly evolving threat likely targeting users seeking software tools or business solutions. If you visited sitesuiteapp.wixstudio.com, especially if you entered any login credentials, immediately change the passwords for any accounts you may have shared. Run a full antivirus scan on your device to check for malware or keyloggers. Review all financial accounts and credit reports for suspicious activity. Consider enabling multi-factor authentication on any accounts that offer it. Report the domain to your IT team or security provider if applicable, and avoid accessing the site further. Use this experience to reinforce caution: always verify unexpected login portals by checking the official website URL, looking for HTTPS with a verified certificate (not just any SSL), and confirming the sender’s email address if prompted via unsolicited messages. Stay vigilant—this campaign preys on trust in familiar platforms like Wix and may expand through email or social media lures. [Updates since narrative was generated:] - VirusTotal detections: now 5/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 3c8b6314dfa262958c16db10f4f5eecb TLS cert SHA-256: c2c2f0e645b35156ce5cf39339fbe5ae5ffb02446fe2aeb96da83b6fe9b20ad4 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/sitesuiteapp.wixstudio.com/ JSON API: https://api.destroy.tools/v1/check?domain=sitesuiteapp.wixstudio.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 147,748 domains (46,739 alive under monitoring, 100,687 confirmed takedowns/dead). Site: https://phishdestroy.io