webpublic-bridge[.]wixstudio[.]com

PhishDestroy identifies webpublic-bridge.wixstudio.com as an active generic phishing domain operating under a WixStudio subdomain. The domain was flagged under seed 0be9b9 for hosting a malicious payload designed to deceive users into submitting sensitive credentials or cryptocurrency payments. While the exact brand being impersonated remains under investigation, the threat type is classified as a generic drainer kit campaign, leveraging the widespread trust in Wix-hosted pages to evade initial suspicion. The infrastructure is deliberately misusing legitimate hosting services to lower immediate detection barriers, a common tactic among low-to-medium complexity phishing operations.

This domain resolves to IPv4 address 34.144.206.118 and is secured with a Let’s Encrypt SSL certificate, which enhances its perceived legitimacy. VirusTotal currently shows 0 detections out of 95 scanners, indicating that the payload remains undetected by major antivirus engines at the time of analysis. The domain was registered through a third-party registrar and is hosted on Google Cloud Platform infrastructure, as inferred from the IP geolocation. The creation date, Google Safe Browsing (GSB) status, and inclusion on public blocklists are currently under further forensic review. The absence of detections suggests either a newly deployed campaign or one utilizing polymorphic or obfuscated code to bypass signature-based detection.

As of this assessment, the campaign is classified as active with an under-investigation risk level. Immediate containment measures include adding the domain and IP to enterprise and personal blocklists, disabling access via DNS sinkholing, and flagging the SSL certificate for revocation where feasible. Users are advised to avoid interacting with any links or forms hosted on this domain and to report it through official cybersecurity channels. While the SSL certificate and WixStudio hosting provide initial camouflage, the lack of detections and active status pose a moderate risk to uninformed users. Continuous monitoring is required to track lateral movement, payload evolution, or infrastructure shifts. Remaining risk includes potential expansion into additional subdomains or use of this domain as a redirector to more sophisticated phishing or malware delivery sites.