liveus-platform[.]wixstudio[.]com

PhishDestroy identifies liveus-platform.wixstudio.com as an active brand impersonation phishing domain targeting users of a well-known platform. The site leverages the WixStudio subdomain to masquerade as a legitimate service, likely aiming to harvest login credentials or deploy a crypto drainer under false pretenses. No specific drainer kit has been publicly documented for this domain, but the structure suggests a classic credential theft campaign designed to exploit user trust in familiar web services.

Technical indicators confirm this domain’s malicious intent. VirusTotal flags the site with a detection ratio of 4/95 security vendors, indicating low but concerning coverage. The domain resolves to IP address 34.144.206.118 and is registered via an unconfirmed registrar, with no publicly available creation date. The SSL certificate, issued by Let’s Encrypt, provides a false sense of security but does not validate the domain’s legitimacy. Google Safe Browsing (GSB) has not yet blacklisted this domain, and it appears on 1 known security blocklist, including PhishingArmy.

Despite its limited detection footprint, this domain remains active and poses an ongoing risk to unsuspecting users. Security teams recommend immediate blocking of the domain and IP address, along with user education on verifying URLs before entering credentials. While the immediate threat is contained by existing blocklists, the domain’s active status and low VT coverage underscore the need for vigilance. Remaining risk is moderate but could escalate if the campaign expands or adopts more sophisticated obfuscation techniques.