openlivedesktop[.]wixstudio[.]com

PhishDestroy identifies openlivedesktop.wixstudio.com as an active phishing domain posing as a legitimate cloud desktop service, specifically engineered to harvest user credentials under the guise of a login portal. This domain is currently under investigation but remains unflagged on VirusTotal with 0/95 detections as of the latest scan, despite its malicious intent. The infrastructure is hosted on IP 34.144.206.118, secured with a Let's Encrypt SSL certificate to appear legitimate, and leverages the WixStudio subdomain to exploit trust in reputable hosting platforms. This domain was flagged by PhishDestroy's threat intelligence pipeline using seed 179055 and exhibits several red flags that warrant immediate caution. The domain resolves to IP 34.144.206.118, which has no established trust score in public reputation databases and shows no prior association with legitimate cloud desktop services. The SSL certificate issued by Let's Encrypt is valid but does not guarantee the domain's legitimacy, as threat actors frequently abuse free certificate authorities to enhance phishing credibility. As of this assessment, VirusTotal reports 0/95 detection engines flagged the domain or its IP, indicating a low initial detection rate, typical of newly emerged phishing campaigns. The domain is registered under Wix Inc.'s infrastructure, leveraging their subdomain service (wixstudio.com) to lend false legitimacy to its fraudulent operations. There are no current entries in major blocklists such as PhishTank, OpenPhish, or Google Safe Browsing, further emphasizing the need for proactive user vigilance and organizational threat intelligence monitoring. To mitigate the risk posed by openlivedesktop.wixstudio.com, users and organizations must treat this domain as a high-priority threat and avoid any interaction, including credential submission or file downloads. Organizations should immediately block the domain and its resolving IP (34.144.206.118) at the network perimeter using DNS sinkholing, firewall rules, or secure web gateway policies. Security teams should also deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate thumbprint across endpoint detection and response (EDR) systems to identify lateral movement or internal reconnaissance attempts. Additionally, user awareness training should highlight the tactics used by this campaign, including the abuse of legitimate hosting platforms and free SSL certificates, to reduce susceptibility to credential theft and social engineering attacks. PhishDestroy advises reporting this domain to threat intelligence platforms and local CERT teams to accelerate collective defense measures.