robot-desktop[.]wixstudio[.]com

This domain is flagged for credential harvesting phishing activity targeting users through deceptive login interfaces. Analysis indicates the site was designed to mimic legitimate authentication portals, likely to capture usernames, passwords, and other sensitive credentials before being taken offline. The threat type is classified as generic_phishing with an elevated risk level due to its infrastructure and detection history. Infrastructure analysis reveals the domain robot-desktop.wixstudio.com resolves to IP address 34.144.206.118, hosted on Google Cloud infrastructure with HTTP/3 and Google Cloud CDN support. The domain was registered through GoDaddy.com, LLC on May 06, 2026, an anomalous creation date suggesting potential domain spoofing or backdating. Security vendors on VirusTotal flagged the domain at a 6/95 detection rate, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Technologies detected include Wix, React, and a Let's Encrypt SSL certificate, which are commonly abused to lend false legitimacy to phishing campaigns. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP (34.144.206.118) at the network perimeter. Security teams should monitor for indicators of compromise, particularly unauthorized access attempts linked to credentials potentially harvested by this domain. Given the anomalous creation date, organizations should review domain registration logs for similar spoofing patterns. End-users should be educated on recognizing phishing attempts, especially those leveraging cloud hosting services and legitimate-looking SSL certificates. If the domain resurfaces, security teams should treat it as a high-priority threat and conduct forensic analysis to determine the scope of any potential credential exposure.