get-desktop-live[.]wixstudio[.]com

This domain, get-desktop-live.wixstudio.com, is identified as a generic phishing page designed to harvest Microsoft account credentials. Analysis indicates the infrastructure was hosted on Wix Studio, a legitimate website builder, but repurposed for malicious activity. No specific drainer kit signatures were detected, though the domain likely mimicked Microsoft login portals to deceive victims into submitting sensitive information. Infrastructure analysis reveals the following technical indicators: the domain was flagged by 9 out of 95 security vendors on VirusTotal, registered through GoDaddy.com, LLC with a creation date of April 27, 2026—anomalously future-dated, suggesting potential domain spoofing or registry manipulation. It resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure with SSL encryption provided by Let's Encrypt. The domain appeared on one security blocklist and was detected using technologies including Wix, Envoy, React, Google Cloud, and Google Cloud CDN. No Google Safe Browsing (GSB) detections were recorded at the time of analysis. The domain is currently offline, having been taken down following detection by security systems. While the immediate threat has been mitigated, residual risk remains for users who may have interacted with the page before its removal. Organizations are advised to monitor for credential reuse attempts and implement multi-factor authentication (MFA) to mitigate potential account compromise. The future-dated registration and use of legitimate cloud services underscore the need for continuous monitoring of subdomain-based phishing campaigns, particularly those leveraging trusted platforms like Wix Studio.