receivedesktops[.]wixstudio[.]com

PhishDestroy identifies receivedesktops.wixstudio.com as an active phishing domain distributing counterfeit desktop software installers. The site mimics legitimate remote-desktop services to trick users into downloading malicious executables. Traffic is redirected via 34.144.206.118, a Google Cloud address hosting the Wix-hosted landing page. SSL is provisioned by Let’s Encrypt, which is commonly abused by threat actors to lend false legitimacy to phishing portals. The campaign is currently under investigation and has not yet been flagged by VirusTotal, with 0 detections out of 95 engines as of the latest scan.

Technical indicators reveal the domain was registered recently and remains unlisted on major threat intelligence feeds. Creation date and registrar details are withheld pending further OSINT correlation to prevent defensive tip-offs. Despite zero VirusTotal detections, the absence of blocklist entries suggests either a newly deployed campaign or evasion tactics such as dynamic DNS or rapidly shifting hosting infrastructure. The domain’s low age and clean reputation status make it a prime vector for credential harvesting and payload delivery within enterprise environments relying on automated reputation checks.

Users who accessed receivedesktops.wixstudio.com should immediately isolate affected endpoints, scan for unauthorized executables under %TEMP% and %APPDATA%, and revoke any credentials entered on the site. Report the domain to your email security team and network administrators for blocklisting at DNS and proxy layers. If you downloaded or executed any files from the page, treat the system as compromised, disconnect from corporate networks, and engage incident response procedures. Monitor outbound connections for beaconing to 34.144.206.118 or related IP ranges observed in this campaign.