host-desktop[.]wixstudio[.]com

PhishDestroy identifies host-desktop.wixstudio.com as a live phishing domain impersonating a remote desktop login portal to harvest Microsoft credentials. The site is hosted on Wix’s WixStudio subdomain and leverages a generic-looking login interface to trick victims into entering their Microsoft account credentials. No specific brand or drainer kit has been linked to this campaign, but the page’s UI mimics standard Windows Remote Desktop prompts to increase credibility among targeted users. The threat actor behind this infrastructure appears to be testing a low-cost, high-volume approach rather than deploying a sophisticated, branded drainer kit.

Technical indicators confirm this domain is dangerous: VirusTotal currently shows 0 detections out of 95 engines (4/95), indicating it remains undetected by most antivirus and security platforms. The domain resolves to IP address 34.144.206.118, which is hosted on Google Cloud (ASN 15169). The SSL certificate is issued by Let’s Encrypt and remains valid, adding a false sense of legitimacy. The domain was registered recently and has not been flagged by Google Safe Browsing (GSB status: clean) as of the latest scan, though this may change as threat intelligence spreads. It has not yet appeared on major blocklists, indicating it is still in early propagation phases.

Current status shows this phishing domain remains active and continues to serve its fake login page without interruption. PhishDestroy recommends immediate blocking of this domain at the network and endpoint level due to the high risk of credential theft. Users are advised not to interact with any links or login prompts from this domain, especially those claiming to provide remote desktop access. While the current risk is elevated due to zero detections and active hosting, the lack of blocklist presence suggests the threat intelligence community has not yet fully analyzed this campaign. Security teams should monitor for updates as this domain may soon be added to threat feeds and blocklists. Until then, treat all traffic to host-desktop.wixstudio.com as malicious.