homepage-paypl[.]wixstudio[.]com

This domain, homepage-paypl.wixstudio.com, is identified as an active phishing infrastructure designed to impersonate PayPal’s payment verification system. Analysis indicates the site presents fraudulent login interfaces to harvest credentials, payment details, and personal information from victims under the guise of account security checks. The threat actor appears to target users through deceptive emails or messages directing them to verify transactions, exploiting trust in the PayPal brand to facilitate unauthorized access to financial accounts. Infrastructure analysis reveals the domain resolves to the IP address 34.144.206.118, hosted on a platform that allows rapid deployment of subdomains under wixstudio.com, a legitimate service often abused for phishing. As of the latest scan, the domain has evaded detection by major security engines, registering 0 out of 95 detections on VirusTotal. No registrar or creation date metadata is publicly available due to the subdomain’s nested structure, which obscures traditional WHOIS visibility. The domain remains unlisted on prominent blocklists, allowing it to operate without immediate mitigation. Users who have visited homepage-paypl.wixstudio.com or entered credentials on the site should immediately revoke any sessions linked to the account, enable multi-factor authentication, and monitor for unauthorized transactions. Financial institutions should be notified if payment details were submitted. Security teams are advised to flag the domain and its resolving IP (34.144.206.118) for internal blocking, while awaiting further detection updates from threat intelligence feeds. Vigilance is recommended for similar subdomain-based phishing attempts leveraging cloud hosting platforms.