home-bitbauy[.]wixstudio[.]com

This investigation documents the malicious infrastructure associated with home-bitbauy.wixstudio.com, a domain observed in active phishing campaigns as of the report date 29 July 2026. The domain was registered on 8 June 2026 through the Wix Studio service, a popular website‑builder platform that allows rapid deployment of sub‑domains. Within a week of creation the domain appeared on a security blocklist and was subsequently added to the PhishDestroy blocklist, indicating that at least one reputable anti‑phishing feed has identified it as hostile. VirusTotal analysis shows that 15 of 91 scanning engines returned a positive verdict, reinforcing the suspicion of malicious intent.

The detection count suggests that a minority of scanners have recognized the payload or URL patterns, while the majority remain silent, a common pattern for newly minted phishing sites that employ evasive techniques. No additional intelligence such as IP address, autonomous system number, hosting provider, SSL certificate details, HTTP response codes, or page title has been released publicly, limiting the depth of technical profiling. Consequently, the precise hosting location, server configuration, and any TLS fingerprint remain unknown. Defenders should treat any traffic to home-bitbauy.wixstudio.com as malicious.

Network‑level controls ought to block the domain at firewalls and DNS resolvers, and endpoint security solutions should be updated to include the domain hash in their block lists. Continuous monitoring of the domain’s reputation across multiple threat intel platforms is recommended, as the detection landscape may evolve rapidly. Organizations that employ URL filtering should ensure that the domain is explicitly denied, and security teams should investigate any recent authentication attempts that may have involved the domain to detect potential credential harvesting.