en-bridges[.]wixstudio[.]com

This domain, en-bridges.wixstudio.com, is flagged as a credential harvesting phishing site designed to mimic legitimate Wix Studio pages. Analysis indicates the threat actor leveraged the Wix Studio subdomain structure to create a plausible facade, likely targeting users through deceptive login prompts or account verification forms. No direct association with known crypto drainer kits or brand impersonation of third-party services was observed, though the 404 error page suggests prior malicious content was removed or relocated. Infrastructure analysis reveals the domain was registered on March 22, 2026, through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure in the United States. At the time of assessment, the domain was detected by 10 out of 95 security vendors on VirusTotal, with a single appearance on a security blocklist. The Google Safe Browsing (GSB) status was not explicitly provided, but the domain’s presence on PhishDestroy’s blocklist corroborates its malicious classification. The domain has since been taken offline, likely due to enforcement actions by the hosting provider or registrar. However, residual risk persists, as threat actors may re-establish the campaign under similar subdomains or shift infrastructure to evade detection. Users are advised to verify domain authenticity before entering credentials, and organizations should monitor for related subdomains or IPs associated with this infrastructure. Continuous scrutiny of newly registered domains with similar naming patterns is recommended to preempt further abuse.