atumic[.]wixstudio[.]com

PhishDestroy identifies atumic.wixstudio.com as an active fake invoice phishing domain under investigation. This WixStudio-hosted site mimics legitimate billing portals to deceive users into submitting payment credentials or sensitive financial data. The threat is classified as high-risk due to its active deployment of fraudulent invoice templates and impersonation tactics targeting businesses and consumers. Current evidence suggests this domain is part of a coordinated campaign leveraging Wix’s free hosting tier to evade immediate takedowns while maintaining operational persistence.

atumic.wixstudio.com resolves to IP address 34.144.206.118, assigned to Google Cloud, which is commonly abused by threat actors due to its high availability and permissive hosting policies. The domain uses a Let’s Encrypt SSL certificate, increasing its legitimacy appearance. VirusTotal analysis indicates 3 out of 95 security engines currently flag the domain, highlighting a detection gap that attackers exploit to avoid immediate blocklisting. While the creation date and registrar information remain unverified in this dataset, the absence of detections and active SSL usage suggests recent deployment and evasion of traditional security controls. The domain remains unblocked across major threat intelligence feeds, enabling ongoing access to potential victims.

To mitigate exposure to fake invoice phishing via atumic.wixstudio.com, organizations should block the domain and IP 34.144.206.118 at the network perimeter and DNS level. Users should be warned not to interact with unexpected billing notifications, especially those hosted on consumer-grade platforms like WixStudio. Report suspicious activity to your IT security team or use fraud reporting tools from major browsers and email providers. Domain registrars and hosting providers should be alerted to the abuse, as WixStudio has a responsibility to investigate and suspend fraudulent subdomains under its platform policies.