global-learn-desktop[.]wixstudio[.]com

PhishDestroy identifies global-learn-desktop.wixstudio.com as an active credential theft domain under investigation. This Wix-hosted subdomain is suspected to impersonate educational service login portals, luring victims into divulging credentials under false pretenses. The threat remains active as of the latest analysis and continues to pose a risk to unsuspecting users.

This domain was flagged by 6 out of 95 VirusTotal vendors during initial analysis, indicating a low detection rate despite active hosting. The subdomain resolves to IP address 34.144.206.118 via a Let's Encrypt SSL certificate, suggesting an attempt to establish trust. WixStudio is the hosting platform, though the domain’s creation date and blocklist presence remain unverified at this time. The absence of detections highlights the stealthy nature of this campaign, which relies on domain legitimacy cues rather than overt malicious signatures.

Given the confirmed active status and lack of vendor detection, PhishDestroy recommends immediate network and endpoint blocking of global-learn-desktop.wixstudio.com. Users should avoid interacting with this domain and report any exposure to security teams. Security solutions should be updated to include behavioral analysis to detect similar credential theft campaigns. Organizations are advised to conduct user awareness training focused on verifying domain authenticity before entering credentials, especially for login portals.