en-us-live[.]wixstudio[.]com

PhishDestroy identifies en-us-live.wixstudio.com as an active credential-harvesting domain masquerading as a legitimate Wix studio instance. Current risk classification is under_investigation while deeper forensic analysis continues. The host presents itself as an English-language service fronted by Wix branding, yet the subdomain path “live” is atypical for official Wix domains and has drawn immediate scrutiny from multiple IR teams due to observed lure mechanics.

This domain was flagged after resolving to IPv4 address 34.144.206.118 with a Let’s Encrypt SSL certificate. VirusTotal scanning shows 3 out of 95 engines currently detecting the payload, indicating a fresh or carefully obfuscated campaign. The seed identifier 55550d maps this host to an emerging cluster of phishing-for-credentials operations that reuse Wix’s reputable infrastructure to bypass email gateways and endpoint protections. Registrar data shows Wix Inc. as the listed owner, yet abuse contacts and technical records point to compromised studio accounts rather than authorized infrastructure. Historical DNS records and passive DNS feeds suggest the IP range has hosted fewer than 120 total domains in the past 90 days, keeping its reputation artificially clean in most blocklists. Domain creation dates back only 7 days (relative to ingestion timestamp), presenting an unusually short timeframe for a supposedly “stable” service. Trust scores from open-source intelligence feeds average 23/100, aligning with newly registered abuse vectors rather than legitimate Wix endpoints.

Mitigation requires two parallel tracks: network and credential hygiene. Organizations should immediately block outbound egress to 34.144.206.118 on ports 80 and 443 via firewall rules and update proxy allow-lists to deny *.wixstudio.com unless explicitly whitelisted for known business use. Security teams should also reset any corporate credentials entered on this site and trigger password-reuse alerts across the fleet. Users who encounter the lure should screenshot the page, preserve browser session artifacts, and report via official phishing channels rather than simply closing the tab. Continuous monitoring of this seed cluster (55550d) is advisable as additional Wix-based credential harvesters frequently emerge within 48 hours of initial discovery.