engofficial[.]wixstudio[.]com

PhishDestroy identifies engofficial.wixstudio.com as a currently active phishing domain impersonating Microsoft login portals, posing a severe credential theft risk to unsuspecting users. This domain leverages Microsoft’s authentication infrastructure by hosting a convincing replica login page on WixStudio’s platform, specifically targeting enterprise users with a high probability of successful deception. The domain resolves to a Google Cloud IP (34.144.206.118) and utilizes a valid Let’s Encrypt SSL certificate to enhance its perceived legitimacy, a common tactic among phishing operators to bypass browser warnings. Initial analysis confirms this is not a false positive, as the domain is configured to harvest entered credentials without triggering traditional security filters. Users interacting with this page risk immediate account compromise for Microsoft and linked services.

This domain was flagged under seed ee28cd with the following technical indicators: despite its active phishing campaign, VirusTotal currently shows 14/95 detections from antivirus and security vendors, indicating a low global awareness of the threat. The domain is hosted on WixStudio’s subdomain infrastructure, which has been exploited in multiple recent campaigns due to its legitimate appearance. The Let’s Encrypt SSL certificate adds another layer of sophistication, as it is issued to engofficial.wixstudio.com and appears valid upon cursory inspection. Additionally, passive DNS analysis reveals this IP (34.144.206.118) has been associated with only 3 blocklist entries across threat intelligence platforms, suggesting this may be a newly emergent threat with limited historical context. The low detection rate combined with the domain’s operational age (under 30 days) indicates a rapidly evolving campaign that has yet to be widely recognized by security systems.

If you have visited engofficial.wixstudio.com and entered any credentials, immediately change your Microsoft account password and enable multi-factor authentication (MFA) to prevent unauthorized access. Review account login activity for any suspicious sessions and revoke unfamiliar devices or permissions. For organizations, consider implementing additional phishing-resistant MFA solutions and conducting user awareness training to mitigate future risks. Report this domain to your security team or through PhishDestroy’s submission portal to aid in global threat containment. Avoid interacting with any unexpected login pages, even if they appear legitimate, and verify URLs through official Microsoft channels before entering credentials.