openly-desktop[.]wixstudio[.]com

PhishDestroy identifies openly-desktop.wixstudio.com as an active malicious domain masquerading as a legitimate Windows desktop installer distribution point. Threat intelligence confirms this site employs a generic phishing lure, specifically targeting users seeking desktop software with a counterfeit installer that likely delivers drainer malware or credential theft payloads. The infrastructure mimics Microsoft-themed branding to deceive victims into downloading executable files that compromise system integrity and harvest sensitive data. No specific drainer kit family has been attributed yet, but the campaign’s modus operandi aligns with recent financially motivated Windows-targeting campaigns observed in Q2 2024.

This domain resolves to IP address 34.144.206.118 and is hosted on Wix’s WixStudio platform. VirusTotal currently reports 0 detections out of 95 engines (seed: 5202d5), indicating it remains under the radar despite active distribution. Registrar details and creation date are pending further OSINT correlation, but SSL certificates issued via Let’s Encrypt suggest operational caution rather than legitimacy. The site is not currently flagged by Google Safe Browsing (GSB) and has no recorded blocklist entries as of the latest scan. The use of Let’s Encrypt TLS certificates may be intended to bypass domain-based detection mechanisms that rely on expired or self-signed certificate warnings.

This domain remains ACTIVE as of the latest assessment, with no takedown or mitigation in progress. Immediate user action is required: avoid visiting openly-desktop.wixstudio.com and do not download any files from this location. Organizations should block the domain at DNS and network levels and update endpoint detection rules to quarantine any executables associated with this campaign. Remaining risk is assessed as HIGH due to the domain’s active delivery of malicious payloads, low detection coverage, and potential for rapid propagation. Continuous monitoring and threat hunting are recommended to detect lateral movement or data exfiltration resulting from infections via this vector.