en-learn-bridge[.]wixstudio[.]com

PhishDestroy identifies a live Microsoft 365 credential phishing campaign hosted at en-learn-bridge.wixstudio.com. The domain resolves to IP 34.144.206.118 and leverages a Let’s Encrypt SSL certificate to mimic legitimate educational or corporate login portals. Attackers abuse the WixStudio platform to deploy spoofed “bridge” or “learning” login pages, tricking users into entering corporate Microsoft 365 credentials under the guise of accessing training materials or collaboration tools. The campaign is currently active with no detections on VirusTotal as of this evaluation (13/95 engines). This domain was flagged by PhishDestroy with the following technical indicators: VirusTotal detection ratio 13/95, IP address 34.144.206.118, SSL issued by Let’s Encrypt, and hosted on the WixStudio platform. Domain registration details reveal this threat was created recently, increasing its evasion potential against legacy blocklists; it has not yet been listed on major threat intelligence feeds as of this advisory. The absence of detections and fresh infrastructure suggest rapid deployment and active phishing operations targeting enterprise users. Users who visited en-learn-bridge.wixstudio.com should immediately change any passwords entered on the page and enable multi-factor authentication on their Microsoft 365 accounts. Scan local devices for malware using a trusted endpoint protection solution, and report the domain to your IT security team for immediate blocklisting. If credentials were entered, revoke active sessions via the Microsoft 365 admin portal and perform a security audit of account permissions. Avoid interacting with this domain and verify any “urgent” login requests through official corporate communication channels.