eng-livedesktop.wixstudio.com — Credential Harvesting Phishing

This domain, eng-livedesktop.wixstudio.com, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates no direct association with a specific brand or known phishing kit, though the use of Wix Studio’s subdomain infrastructure suggests an attempt to exploit perceived legitimacy. The domain’s generic design and lack of overt branding imply a broad targeting approach, likely aimed at capturing credentials from multiple platforms or services. Infrastructure analysis reveals the domain was registered on April 9, 2026, through GoDaddy.com, LLC, a common registrar for both legitimate and malicious domains. It resolves to the IP address 34.144.206.118, a host associated with cloud-based services that may facilitate rapid deployment and takedown of phishing pages. At the time of assessment, the domain was flagged by 6 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It appears on one security blocklist and was actively blocked by at least one threat intelligence feed. The SSL certificate, issued by Let’s Encrypt, provides basic encryption but does not validate the site’s legitimacy, as such certificates are freely available and frequently abused in phishing campaigns. The domain is currently offline, likely due to takedown actions or infrastructure adjustments by the threat actor. However, the elevated risk level persists due to the potential for re-deployment under a new subdomain or domain. Users who may have interacted with this site should immediately reset credentials for any accounts entered on the page, particularly if passwords were reused across platforms. Organizations are advised to monitor for similar subdomain-based phishing attempts within Wix Studio or other website builder platforms, as these services are increasingly leveraged to bypass traditional domain reputation systems. Continuous vigilance and multi-factor authentication remain critical defenses against credential harvesting threats.