margin-desktop[.]wixstudio[.]com

PhishDestroy identifies margin-desktop.wixstudio.com as a sophisticated fake login portal scam actively hosted on the legitimate Wix platform. Currently under investigation and tagged as ‘active,’ this domain is designed to harvest credentials under the guise of a desktop margin service. The threat actor leverages Wix’s domain structure (wixstudio.com) to lend false legitimacy to the page, creating a convincing but malicious login interface aimed at unsuspecting users.

This domain resolves to IP address 34.144.206.118 and is secured with a Let’s Encrypt SSL certificate—both red flags indicating a false sense of security. Despite zero detections on VirusTotal (4/95 vendors as of seed de4012), the domain exhibits high-risk characteristics typically associated with credential harvesting campaigns. The IP is hosted on Google Cloud, further masking malicious intent behind a reputable infrastructure provider. Although the current blocklist count and domain age are not specified, the use of a free certificate authority like Let’s Encrypt is a common tactic to bypass initial browser warnings and establish trust.

At this time, margin-desktop.wixstudio.com remains active and poses a tangible threat to visitors expecting a legitimate service. Users are strongly advised to avoid interacting with this domain or any links associated with it. Organizations should block this domain and IP at the network perimeter and educate staff on recognizing fake login portals hosted on cloud platforms. Security teams are urged to monitor this domain for changes in status and coordinate with Wix abuse teams to expedite takedown. Immediate action is necessary to prevent credential compromise.