engine-desktoplive[.]wixstudio[.]com

PhishDestroy identifies engine-desktoplive.wixstudio.com as an active credential-harvesting domain masquerading as a desktop software installer. This WixStudio-hosted page mimics legitimate software interfaces to trick users into surrendering login credentials under the guise of a required update or installation routine. Security researchers note the domain employs real-time content generation to evade static detection, using Let’s Encrypt SSL to appear benign while hosting deceptive forms targeted at Microsoft, Adobe, and Google accounts. This domain was flagged with 0 detections out of 95 engines on VirusTotal at 122fec seed, indicating it has not yet been widely recognized by automated scanners. It resolves to a Google Cloud IP (34.144.206.118), which is commonly abused by phishing operators due to its high reputation and traffic volume. The domain is hosted on WixStudio, a legitimate website builder, which highlights how attackers increasingly abuse trusted platforms to host phishing content. While registration metadata is obscured, the domain’s recent appearance and lack of historical trust signals elevate its risk profile. Users who visited engine-desktoplive.wixstudio.com should immediately cease inputting any credentials and close the browser tab. Do not interact with any forms or download prompts. If credentials were entered, change passwords immediately on a separate trusted device and enable multi-factor authentication where available. Clear browser cache and cookies related to the site. Report the domain to your organization’s security team or to PhishDestroy using the unique seed 122fec for tracking. Monitor accounts for unusual activity and consider revoking any OAuth tokens linked to compromised credentials. This domain remains active and under investigation; treat all content as malicious until proven otherwise.