choose-desktop[.]wixstudio[.]com

Analysis of choose-desktop.wixstudio.com, a domain flagged as an active phishing threat, reveals infrastructure and detection patterns consistent with credential-harvesting campaigns. The domain is currently listed on one security blocklist (PhishDestroy) and remains operational as of July 25, 2026. It resolves to IP address 162.159.143.12, a Cloudflare-hosted endpoint, which may complicate origin tracing. Infrastructure analysis indicates the domain was registered through Wix.com Ltd., a legitimate platform often abused for rapid deployment of phishing pages due to its free-tier hosting and subdomain flexibility. No nameservers are currently associated with the domain (NS_NOT_FOUND), which may suggest recent deregistration or an attempt to evade detection.

The absence of nameserver records does not prevent resolution, as the domain continues to serve content via Cloudflare's CDN. While the exact content of the site is not yet analysed, the domain name ('choose-desktop') implies a focus on desktop-related services, potentially targeting users seeking software downloads, remote desktop tools, or enterprise IT services. This aligns with common phishing tactics leveraging urgency or perceived legitimacy around workplace technology. Defenders should treat this domain as high-risk until further analysis confirms its intent.

The IP 162.159.143.12 should be monitored for additional malicious subdomains, and network-level blocking is recommended based on the existing blocklist entry. Given the domain's registration via Wix, security teams may also investigate other Wix-hosted subdomains for similar patterns. No additional detection vendors, SSL anomalies, or brand-specific indicators are currently available, limiting attribution to a specific threat actor or campaign. Further investigation, including HTTP response analysis and payload inspection, is required to determine the full scope of the threat.