desktop-enledgar[.]wixstudio[.]com

PhishDestroy identifies desktop-enledgar.wixstudio.com as a malicious domain actively leveraging Microsoft OneDrive impersonation to harvest credentials. This domain was flagged under our generic phishing category and remains under investigation due to its active status and suspicious infrastructure. The domain resolves to IP 34.144.206.118, which is currently undetected by 95 VirusTotal engines, raising concerns about its evasion capabilities against standard security measures. The presence of a valid Let's Encrypt SSL certificate suggests an attempt to appear legitimate, while the WixStudio hosting platform may be leveraged to bypass traditional enterprise blocklists.

Technical analysis reveals this domain poses a tangible credential harvesting risk. Current intelligence indicates 0 detections across all VirusTotal scanning engines, underscoring its stealthy nature. The SSL certificate, issued by Let's Encrypt, covers the domain but does not mitigate the underlying phishing intent. While the exact creation date and registrar details remain unverified, the lack of detections across 95 engines suggests this may be a recently deployed or dynamically changing threat. The absence of current blocklist coverage further increases the risk of successful exploitation. Users interacting with this domain may unknowingly submit sensitive credentials to a threat actor-controlled server.

Users who have encountered this domain should immediately cease all interactions and avoid entering any credentials. Report the domain to your security team or through your organization's phishing reporting mechanism. If credentials were entered, change passwords immediately and enable multi-factor authentication where available. Organizations should consider blocking the domain at the network level and inspecting DNS logs for historical queries. This domain remains under active investigation, and additional IOCs may be released as analysis continues.