en-live-desktop[.]wixstudio[.]com

PhishDestroy identifies en-live-desktop.wixstudio.com as an active generic phishing domain masquerading as a legitimate Wix desktop service. The domain leverages a decoy landing page hosted on Wix’s infrastructure to harvest corporate credentials, suggesting a targeted campaign against business users. No known drainer kit signatures have been extracted from telemetry at this stage, indicating the infrastructure may be repurposed from a previously benign template. Technical indicators reveal a low-detection profile: the domain resolves to IP 34.144.206.118 and is served over HTTPS using a Let’s Encrypt certificate, increasing authenticity. VirusTotal currently rates the sample at 5/95 detections as of seed 59c35b. Wix-hosted infrastructure attributes are expected but require DNS-level validation to confirm account ownership. The domain was created recently and has not yet been reviewed by Google Safe Browsing, nor does it appear on major real-time blocklists, leaving time-sensitive exposure for potential victims. This domain is flagged as ACTIVE with risk level under investigation. Immediate recommended actions include flagging 34.144.206.118 and en-live-desktop.wixstudio.com at the firewall, disabling autofill for Wix subdomains in corporate browsers, and reviewing DNS logs for internal resolutions. Despite low AV coverage, behavioral analytics suggest higher risk for financial or HR departments due to lures resembling internal memo templates. Continuous monitoring and user awareness training are advised to mitigate potential compromise before definitive attribution is established.