ephraimabiojiega[.]wixstudio[.]com

PhishDestroy identifies ephraimabiojiega.wixstudio.com as an active credential-stealing phishing site posing as a biotech company portal. This WixStudio subdomain (resolving to 34.144.206.118 on Google Cloud) is designed to trick users into surrendering login credentials under the guise of accessing exclusive research materials or job applications. The threat actors behind this campaign have registered the domain recently and are actively distributing phishing links via email and social media messages, capitalizing on the trust associated with legitimate cloud hosting providers to bypass security filters. This domain was flagged by PhishDestroy during routine threat intelligence monitoring. VirusTotal currently shows 4/95 security engines detecting the malicious content, indicating that traditional antivirus solutions have not yet updated their signatures to recognize this threat. The domain is secured with a valid Let's Encrypt SSL certificate (issued within the last 7 days), which further enhances its credibility in the eyes of unsuspecting users. The hosting infrastructure is traced back to Google Cloud's IP range (34.144.206.118), a common tactic among phishing operators to obscure the true origin of their operations. WixStudio's free hosting platform is being abused to rapidly deploy and discard fraudulent sites, making takedown efforts more challenging for security teams. If you or someone in your organization has visited ephraimabiojiega.wixstudio.com, immediately cease any interaction with the site and avoid entering any credentials, personal information, or payment details. Scan all connected devices with updated antivirus and anti-malware tools, as credential phishing sites like this often deploy browser-based malware or keyloggers. Report the domain to your IT security team and consider resetting passwords for any accounts that may have been exposed, especially if you reused the same credentials across multiple services. Organizations should block the domain at the network level and monitor for any signs of credential misuse or lateral movement within their systems.