us-getdesktop[.]wixstudio[.]com

PhishDestroy identifies the domain us-getdesktop.wixstudio.com as hosting a generic phishing payload designed to mimic legitimate desktop installer software. Current evidence indicates active deployment of this lure, with no confirmed association to a specific brand. The campaign leverages a WixStudio subdomain to lend an air of legitimacy while distributing a suspected phishing binary or credential harvesting interface. Due to the absence of AV detections and recent launch, further analysis is required to determine the exact payload mechanism and long-term infrastructure goals.

This domain was flagged by 4 of 95 VirusTotal vendors as of time of analysis, possesses a Let’s Encrypt SSL certificate, and resolves to IP address 34.144.206.118. No registrar, creation date, or blocklist membership data is available via public sources at this time. Trust scores remain neutral given the lack of historical detections, suggesting a newly provisioned or opportunistic hosting environment. The 34.144.206.118 IP is allocated within a Google Cloud Platform range, which is frequently abused for short-lived phishing operations.

The domain remains active and under active investigation by PhishDestroy. Users are advised to avoid clicking links or downloading files from us-getdesktop.wixstudio.com. Organizations should implement network-level blocking for the domain and associated IP. Browser security extensions and email filtering rules should be updated to flag this domain pending further intelligence. Security teams are encouraged to monitor lateral movement or credential submission attempts originating from endpoints that accessed this site. Immediate containment is recommended given the potential for data exfiltration or malware deployment.