siteus-bridge[.]wixstudio[.]com

The domain siteus-bridge.wixstudio.com has been identified as a confirmed phishing site designed to impersonate the Wix Studio portal. Analysis indicates this infrastructure was used for brand impersonation phishing, likely targeting users of the Wix platform to harvest credentials or distribute malicious payloads. The domain is currently offline, but prior activity suggests it was actively used in a campaign to deceive victims into believing they were interacting with legitimate Wix services.

Infrastructure analysis reveals the domain was flagged by 15 of 95 security vendors on VirusTotal, indicating widespread detection of malicious intent. It was registered through GoDaddy.com, LLC on April 30, 2026, an unusually future-dated creation that may signal domain spoofing or registry manipulation. The domain resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and was associated with technologies including React, Google Cloud CDN, and HTTP/3. The SSL certificate was issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to phishing sites. The domain appeared on three security blocklists, including PhishDestroy and PhishingArmy, and received a trust score of 0/100 from Gridinsoft, further confirming its malicious classification.

As of the latest assessment, the domain is offline, and the 404 error page suggests it may have been taken down by the hosting provider or registrar. However, the infrastructure and registration details remain suspicious. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should review logs for connections to 34.144.206.118 or references to siteus-bridge.wixstudio.com, particularly in web proxy or DNS logs. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Proactive monitoring for similar domains registered through the same registrar or hosted on Google Cloud infrastructure is recommended to mitigate future risks.