now-desktop[.]wixstudio[.]com

now-desktop.wixstudio.com has been flagged by PhishDestroy as a credential theft domain under active investigation. The domain impersonates legitimate Wix services to harvest user credentials, with no current detections on VirusTotal despite its malicious intent. The infrastructure includes a Let's Encrypt SSL certificate and resolves to IP 34.144.206.118, suggesting a hastily deployed but operational phishing kit targeting Wix users.

Technical indicators reveal a concerning lack of detection: VirusTotal currently reports 0/95 detections (seed e1cf6f), indicating zero security vendor flagging. The domain is hosted on Google Cloud (IP 34.144.206.118), likely leveraging cloud services to evade traditional blocklists. No historical WHOIS data was provided, but the use of WixStudio as a subdomain implies an attempt to exploit trusted hosting platforms. Google Safe Browsing (GSB) status remains unverified, and blocklist inclusion is pending due to the recency of the domain's deployment.

The domain's status is active but under investigation, with a current risk level classified as under_investigation. Immediate actions include blocking the domain at the network level and user-level warnings via GSB integration. Remaining risk is high due to the lack of detections and the domain's plausible mimicry of legitimate Wix services. Users are advised to verify URLs before credential entry and report any suspicious activity to PhishDestroy for further analysis.