read-bridge[.]wixstudio[.]com

PhishDestroy identifies active credential harvesting infrastructure hosted on read-bridge.wixstudio.com, a Wix-based domain currently impersonating a login portal to harvest user credentials. The threat is classified as credential harvesting due to observed lures directing victims to a fake login interface designed to exfiltrate authentication data. The campaign remains active as of the latest analysis, with no signs of takedown or remediation.

This domain was flagged by 0 of 95 VirusTotal security vendors, indicating that it has evaded detection by most scanning engines to date. The domain resolves to IP address 34.144.206.118, which is associated with Wix hosting infrastructure. The domain utilizes a valid Let's Encrypt SSL certificate to enhance legitimacy and reduce user suspicion. Historical analysis shows no prior detections on threat intelligence platforms, and trust scores remain neutral due to the novelty of the infrastructure.

The current status of this threat is under investigation, but the active nature of the campaign suggests a need for immediate defensive action. Users are advised to avoid accessing read-bridge.wixstudio.com or any linked subdomains. Organizations are recommended to block the domain at the network perimeter and update firewall rules to prevent outbound connections. Additionally, users should enable multi-factor authentication on all accounts to mitigate the risk of credential theft. Security teams are encouraged to monitor for similar domains and report any sightings to PhishDestroy for further analysis.