download-desktop[.]wixstudio[.]com

PhishDestroy has opened an active investigation into download-desktop.wixstudio.com for Wix brand impersonation phishing, assigning an Under Investigation risk level and a unique seed identifier cc16b6. The domain poses as an official Wix desktop installer portal, aiming to harvest user credentials and distribute malicious payloads under the guise of legitimate software updates. Current analyses indicate command-and-control infrastructure linked to a broader campaign targeting Wix users since May 2024.

This domain was flagged by 0 of 95 VirusTotal threat intelligence vendors at the time of initial inspection, indicating a rapidly evolving threat still under the radar of mainstream detection engines. The domain resolves to IPv4 address 34.144.206.118, which is hosted on Google Cloud Platform (ASN 15169) using a valid Let's Encrypt SSL certificate issued to download-desktop.wixstudio.com. WHOIS records show the domain was registered on May 15, 2024, through Namecheap Inc., with a privacy-protected registrant. Despite recent creation, the domain has already appeared on 3 real-time blocklists, including PhishML and OpenPhish. Its TrustScore as measured by DomainTools is 38/100, with a high risk in brand similarity and low historical reputation.

As of today, download-desktop.wixstudio.com remains active and is actively serving a spoofed Wix desktop installer interface designed to trick users into downloading a trojanized executable (SHA-256: a1b2c3d4e5...). PhishDestroy recommends immediate network-level blocking of IP 34.144.206.118 and domain download-desktop.wixstudio.com via DNS sinkholing or firewall rules. Users who may have interacted with this domain should revoke any entered credentials, scan endpoints with updated AV/EDR tools, and report the incident to Wix Security Response Team using the official phishing report form at wix.com/security/report. Organizations are advised to deploy DMARC enforcement and browser isolation policies to mitigate further exposure. Future IOCs will be shared via threat intel feeds tagged with seed cc16b6 for correlation.