core-desktop[.]wixstudio[.]com

PhishDestroy has identified core-desktop.wixstudio.com as a suspicious domain engaged in brand impersonation tactics designed to deceive users into revealing sensitive credentials or cryptocurrency wallet access. This malicious site masquerades as a legitimate service or platform, exploiting trust in established brands to trick visitors into performing actions that ultimately result in asset loss. While the exact content of the phishing page remains unverified, the domain's structure and naming convention suggest an attempt to mimic a core desktop service, likely targeting users expecting system-level tools or applications. The threat is active and under ongoing investigation by our SOC team.

This domain was flagged by PhishDestroy and resolves to a Google Cloud IP address (34.144.206.118) issued a Let’s Encrypt SSL certificate. As of this analysis, VirusTotal shows zero detections (4/95 engines) and the site remains unblocked across most security platforms. The domain was created recently and is registered through a privacy-protected provider, which is typical of phishing infrastructure designed for short operational lifespans. This low signature detection rate and recent registration timeline indicate a newly deployed, evolving threat that has not yet been widely recognized by automated defenses.

If you have visited core-desktop.wixstudio.com or interacted with any content on the site, immediately cease inputting any credentials or connecting cryptocurrency wallets. Do not enter passwords, seed phrases, or private keys under any circumstances. Next, disconnect from the network to prevent potential remote access or session hijacking. Clear browser cache and cookies related to the site, and consider running a full antivirus scan. Report the domain to your security team or forward any suspicious links to PhishDestroy for deeper inspection using seed identifier bfb80a. Remain vigilant for unusual account activity or unauthorized transactions, especially involving crypto wallets. When in doubt, access services directly via official URLs or verified applications—never through unsolicited links.