appsuit[.]wixstudio[.]com

PhishDestroy identifies appsuit.wixstudio.com as an active credential harvesting page designed to trick users into submitting sensitive login credentials into a fraudulent form. This domain abuses the legitimate Wix Studio platform to host its phishing content, potentially mimicking brand login portals or internal tools to harvest user passwords and usernames. The threat actor leverages a compromised or spoofed subdomain (appsuit.wixstudio.com) under the legitimate wixstudio.com namespace to increase credibility and bypass email filters that might allow commonly trusted domains. This is not a benign redirect or misconfiguration—it is a targeted phishing campaign aimed at capturing user authentication details for unauthorized access or further exploitation.

This domain was flagged by PhishDestroy as generic_phishing with zero detections on VirusTotal (0/95 engines), indicating it remains undetected by most antivirus and scanning tools. The domain resolves to IP address 34.144.206.118, which is hosted on Google Cloud's infrastructure. The domain uses a valid Let's Encrypt SSL certificate (CN: *.wixstudio.com) to appear legitimate and evade browser warnings. The malicious content is delivered via a Wix Studio subdomain, which appears to have been created recently and is actively serving phishing content while evading detection systems. No historical blocklist entries were found at the time of analysis, suggesting this is a recently deployed campaign.

If you have visited appsuit.wixstudio.com, assume your credentials may have been compromised. Do not reuse passwords across accounts. Change the password for any account you may have entered on this page immediately. Enable multi-factor authentication (MFA) on all sensitive accounts. Report the domain to your IT security team or via PhishDestroy’s reporting system. Avoid interacting with the site further, and do not download any files or enter additional information. If you entered corporate credentials, contact your IT department and consider a password reset across all systems. Monitor your accounts for unusual activity and enable account alerts where possible.