profile-bridge[.]wixstudio[.]com

PhishDestroy identifies profile-bridge.wixstudio.com as an active credential theft phishing domain currently under forensic review. This WixStudio-hosted site masquerades as a profile-sharing portal and is designed to harvest user credentials under the guise of a legitimate bridge profile. No specific drainer kit or branded impersonation target has been confirmed at this stage, but the domain’s immediate purpose is clear: to deceive users into surrendering login details under false pretenses. The campaign remains in early deployment, with threat actors leveraging Wix’s free hosting tier to rapidly spin up decoy pages while avoiding immediate detection. The infrastructure choice suggests low-cost experimentation rather than a sophisticated, high-budget operation, yet the potential for credential harvesting remains high due to user trust in Wix-hosted pages.

This domain resolves to IP address 34.144.206.118, a Google Cloud instance likely rented via Compute Engine for its anonymity and rapid provisioning. VirusTotal currently flags the domain with 0 detections out of 95 engines, indicating zero automated detection at the time of analysis. The domain was registered through Namecheap, a registrar known for high anonymity services, and currently holds a valid Let’s Encrypt SSL certificate, increasing its perceived legitimacy. Domain creation date remains under investigation, but the site is actively serving phishing content as of the latest scan. Google Safe Browsing (GSB) has not yet blacklisted the domain, and aggregated threat intelligence platforms report no prior blocklist entries. This combination of fresh infrastructure, low detection, and unflagged status places it in a high-risk window for exploitation.

The campaign is currently active and under active investigation by PhishDestroy. Immediate response actions include domain takedown notifications to Wix, Google Cloud, and Namecheap abuse teams, alongside submission to multiple threat intelligence feeds for faster propagation. Due to the low detection rate and absence of prior flags, users may encounter this domain undetected by browsers or email filters. Recommendations include direct blocking of 34.144.206.118 and the domain at network and endpoint levels. Users should avoid interacting with any unsolicited profile or login prompts, especially those hosted on WixStudio subdomains. Remaining risk is classified as HIGH until takedown is confirmed and detection coverage improves across security platforms.