en-learndesktop[.]wixstudio[.]com

PhishDestroy identifies the domain en-learndesktop.wixstudio.com as an active credential theft phishing site designed to harvest user login credentials. This subdomain under wixstudio.com mimics legitimate educational or desktop learning platforms, likely targeting users seeking software tutorials or system tools. The campaign appears to rely on brand impersonation, leveraging Wix's trusted infrastructure to deceive victims into submitting sensitive login information, which is then exfiltrated to attacker-controlled servers. The exact drainer kit or injection mechanism remains unverified in open-source reporting, but the infrastructure suggests a focus on credential harvesting rather than direct financial drainers. This domain resolves to IP 34.144.206.118 and is associated with a Let's Encrypt SSL certificate, enhancing its appearance of legitimacy. Registered under Wix’s infrastructure, it has not been widely blocked by Google Safe Browsing (GSB). The domain was flagged by 4 out of 95 VirusTotal security vendors, indicating emerging but not yet widespread detection. With only one confirmed blocklist entry, this domain maintains a relatively low public detection footprint despite its active status. Registrar details are obscured due to Wix’s use of subdomains under a managed platform. As of latest analysis, en-learndesktop.wixstudio.com remains active and has not been flagged by major browsers or security suites at scale. Immediate remediation includes blocking the domain at network and endpoint levels using the IP and domain name. Users are advised to avoid interacting with this site and to report it through PhishingArmy or local threat intelligence platforms. While the risk is currently high due to active operations and low blocklist coverage, coordinated takedown efforts may reduce its lifespan. Remaining risk includes continued credential phishing operations against inexperienced users or misconfigured browser allowlists.