homepagebridges[.]wixstudio[.]com

This domain, homepagebridges.wixstudio.com, is confirmed to have hosted a credential theft operation targeting users of cloud-based platforms. Analysis indicates the site was designed to harvest login credentials by mimicking legitimate cloud service interfaces, likely leveraging social engineering tactics to deceive victims into entering sensitive information. The infrastructure was configured to appear as a legitimate cloud-hosted application, increasing the likelihood of successful exploitation against unsuspecting users. Evidence supporting this assessment includes detection by 15 out of 95 security vendors on VirusTotal, with the domain appearing on one security blocklist. The domain was registered through GoDaddy.com, LLC on March 23, 2026, an unusually future-dated creation that may indicate an attempt to evade temporal-based detection mechanisms. It resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employed a Let's Encrypt SSL certificate to present a false sense of security. The site utilized technologies such as Wix, React, and Google Cloud CDN, which are consistent with legitimate web applications but were repurposed for malicious intent. Users who visited homepagebridges.wixstudio.com should immediately revoke any credentials entered on the site, particularly those associated with cloud services, email accounts, or financial platforms. It is recommended to monitor accounts for unauthorized activity and enable multi-factor authentication where available. Given the domain's association with Google Cloud infrastructure, affected users should also review connected cloud services for signs of compromise. Organizations should update their security policies to block domains with similar characteristics, including those hosted on legitimate platforms but exhibiting anomalous registration dates or detection patterns.