live-en-desktop[.]wixstudio[.]com

PhishDestroy identifies live-en-desktop.wixstudio.com as an active phishing domain engineered to deploy Trojan malware onto unsuspecting visitor devices. Threat actors are abusing Wix’s legitimate sub-domain service (wixstudio.com) to host a convincing desktop-simulation lure that prompts users to download a “live update” — in reality a Trojan dropper. Once executed, the payload establishes a reverse-shell back to a command-and-control server hosted on 34.144.206.118, allowing attackers to exfiltrate keystrokes, browser data, and local files, then pivot into internal networks. Security scanners have yet to catch this payload, leaving both individuals and organizations vulnerable.

This domain was flagged under seed 375701 with the following technical indicators: hosting IP 34.144.206.118, SSL certificate issued by Let’s Encrypt (validity period still active), VirusTotal score 0 out of 95 engines 5 hours after initial report, and no presence on major public blocklists at time of analysis. Registry lookup (via seed 375701) shows the sub-domain was created 7 days prior to flagging, hosted on Wix’s IP range 23.236.128.0/17, making take-down procedures reliant on Wix abuse desk escalation rather than upstream network filtering. Because zero engines currently flag the payload, the gap between domain creation and detection widens the attack window for drive-by downloads.

If you visited live-en-desktop.wixstudio.com and clicked any download buttons, immediately isolate the affected device from all networks (including VPN), power off to halt memory-resident malware, and boot from a known-clean recovery image. Use a reputable offline antivirus scanner to inspect storage and quarantine any unrecognized executables. Report the incident to your IT/security team with the domain, IP 34.144.206.118, and exact time of visit. Monitor outbound traffic for connections to unusual ports >1024; if observed, assume credential theft and initiate password resets on all online accounts. Forward the full forensic report to PhishDestroy seed 375701 to accelerate remediation and blocklist updates.