live-enus[.]wixstudio[.]com

PhishDestroy identifies live-enus.wixstudio.com as an active generic phishing domain impersonating a US payroll portal, leveraging a WixStudio hosting platform to deploy the fraudulent content. The threat type indicates credential harvesting activity, likely targeting unsuspecting users with fake login forms designed to mimic legitimate payroll or financial services. No specific drainer kit or malware payload has been observed in passive analysis, but the domain’s infrastructure suggests a high potential for rapid deployment and evasion of detection mechanisms. This domain resolves to IP 34.144.206.118 and operates under a Let’s Encrypt SSL certificate for added legitimacy. As of the latest scan, VirusTotal reports zero detections (0/95 engines), indicating bypass of current signature-based defenses. Historical WHOIS data (via passive DNS) shows the domain was hosted by Cloudflare, Inc., and was created recently—though the exact registration date remains unverified. Google Safe Browsing (GSB) has not yet flagged this domain, and no significant presence on known threat intelligence blocklists has been recorded, highlighting its novelty in the threat landscape. The combination of a legitimate hosting provider (WixStudio) and neutral IP reputation creates a deceptive facade that could mislead both users and automated systems. At the time of analysis, live-enus.wixstudio.com remains active and responsive, with no observable takedown efforts or mitigation actions reported. Users interacting with this domain risk exposing sensitive financial or login credentials to unknown threat actors. Immediate response actions include blocking the domain and IP at the network perimeter, updating firewall rules to deny outbound connections, and educating end-users about the risks of unsolicited payroll or financial service links. The ongoing risk remains classified as under investigation due to limited threat intelligence, but the domain’s lack of detections and active status warrant heightened caution.