faqs-lognlive[.]wixstudio[.]com

PhishDestroy analysts have flagged faqs-lognlive.wixstudio.com as an active credential-harvesting site designed to steal Microsoft account credentials. The fraudulent portal mimics a legitimate FAQ login page, tricking users into entering their user names and passwords. Once harvested, attackers can abuse the credentials to access email, cloud storage, and other sensitive Microsoft services. This domain is currently served from IP address 34.144.206.118 and secured with a Let’s Encrypt SSL certificate to appear legitimate. VirusTotal scanning shows zero detections out of 95 security engines as of the latest check, so traditional antivirus tools do not yet recognize the threat. The Let’s Encrypt certificate was issued recently, indicating the site is newly active and still flying under the radar of most detection systems. If you visited faqs-lognlive.wixstudio.com and entered any credentials, immediately change the password on that account and enable multi-factor authentication. Scan your device with updated antivirus software and review account activity for any unusual logins. Avoid reusing the exposed password on other sites and consider using a password manager to generate and store unique passwords for each account.