screen-bridge[.]wixstudio[.]com

This domain is flagged as a credential harvesting phishing site targeting user login credentials through deceptive web forms. Analysis indicates the threat type as generic_phishing with an elevated risk level, though the domain currently displays a 404 error page from Wix Studio. The discrepancy between the inactive frontend and active malicious indicators suggests infrastructure repurposing or takedown evasion tactics. Infrastructure analysis reveals the domain was registered on April 21, 2026, through GoDaddy.com, LLC, and resolves to IP address 34.144.206.118. It appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal. The domain uses a Let's Encrypt SSL certificate and employs technologies including Wix, React, Google Cloud, Lodash, HSTS, and Google Cloud CDN. A Gridinsoft trust score of 0/100 further confirms malicious classification. Mitigation requires immediate blocking of the domain and its resolving IP 34.144.206.118 at network perimeter controls. Security teams should monitor for credential harvesting patterns associated with Wix-hosted phishing infrastructure, particularly domains using Let's Encrypt certificates and Google Cloud CDN. User awareness training should emphasize verification of Wix-hosted login pages, as legitimate Wix Studio pages display consistent branding and valid SSL certificates. Network logs should be reviewed for connections to 34.144.206.118 or related subdomains since April 2026.