suites-en[.]wixstudio[.]com

PhishDestroy identifies suites-en.wixstudio.com as an active phishing domain posing as a generic service hosted on Wix’s platform. This domain is not associated with any legitimate brand and is being used to harvest credentials and financial data via a generic phishing kit designed to deceive unsuspecting visitors. The threat actor leverages Wix’s hosting infrastructure to lend superficial legitimacy to their campaign, exploiting the platform’s reputation to bypass initial scrutiny. This domain was flagged by 3 of 95 VirusTotal security vendors and resolves to IP address 34.144.206.118. The domain uses a Let’s Encrypt SSL certificate to encrypt traffic, potentially masking malicious payloads from network inspection tools. While the exact creation date and registrar details are not specified in available intelligence, the low detection rate and active hosting status suggest a recently deployed or rapidly evolving campaign. The domain has not been listed on Google Safe Browsing (GSB) and remains unblocked by most threat intelligence platforms, increasing the risk of exposure to end users. As of current reporting, suites-en.wixstudio.com remains active and unblocked, presenting an elevated risk to users who may encounter it through phishing emails, social media links, or compromised advertisements. Immediate action is recommended: block the domain at DNS and network levels, flag the associated IP 34.144.206.118, and update endpoint protection rules to detect any connections to this infrastructure. Users should avoid accessing the domain entirely and report any accidental exposures to their security teams. Remaining risk is elevated due to the domain’s active status, the use of legitimate hosting, and the lack of widespread blocking, necessitating proactive defense measures.