desktop-tower[.]wixstudio[.]com

The domain desktop-tower.wixstudio.com is currently active and has been identified as a generic phishing infrastructure. Registration data shows the domain was created through Wix.com Ltd., a popular website‑builder service, and the authoritative name server information is unavailable (NS_NOT_FOUND). DNS resolution points to the IP address 162.159.143.12, which is associated with Wix’s hosting environment. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy sinkhole, indicating that at least one anti‑phishing organization has observed malicious activity originating from this host.

VirusTotal reports indicate that the domain was submitted to 95 scanning engines, none of which returned a detection at the time of analysis. While the absence of detections does not guarantee benign behavior, it suggests that the payload or landing page may be employing techniques that evade automated signatures. No public information is available regarding SSL/TLS configuration, HTTP response codes, page title, or the specific brand being impersonated, leaving the exact phishing vector undefined.

Given the limited but concrete evidence—registration via Wix, resolution to a Wix‑owned IP, blocklist presence, and active blocking by PhishDestroy—defenders should treat the domain as hostile. Recommended mitigations include adding the domain to outbound filtering rules, monitoring DNS queries for the IP address 162.159.143.12, and employing heuristic or behavior‑based detection to capture potential credential‑stealing pages that may appear under this host. Ongoing intelligence gathering should focus on retrieving the HTTP content, TLS certificate details, and any associated command‑and‑control infrastructure to refine the threat profile.