desktop-engldger[.]wixstudio[.]com

This domain, desktop-engldger.wixstudio.com, is identified as a generic phishing site designed to impersonate legitimate Wix Studio pages. Analysis indicates the threat type involves fake login portals, likely targeting users with credential harvesting tactics. No specific brand impersonation or crypto drainer kit signatures were confirmed, but the domain’s structure and hosting align with known phishing infrastructure. The page title, '404 Error: Page Not Found | Wix Studio,' suggests an attempt to mimic Wix’s error pages, potentially to deceive users into believing the site is part of the legitimate Wix ecosystem. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 34.144.206.118 and is flagged by 12 out of 95 security vendors on VirusTotal. It appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The domain was registered on May 06, 2026, through GoDaddy.com, LLC, an atypical creation date that may indicate domain spoofing or typosquatting. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. Technologies detected include Wix, React, Google Cloud, and Google Cloud CDN, which are consistent with Wix Studio’s legitimate infrastructure but are also leveraged by threat actors to blend in with trusted services. The domain’s Gridinsoft trust score is 0/100, further corroborating its malicious classification. As of the latest assessment, desktop-engldger.wixstudio.com has been taken offline, reducing immediate exposure risks. However, the domain’s registration remains active, and the infrastructure (e.g., IP, hosting provider) may be repurposed for future malicious activity. Users who accessed the domain prior to its takedown should assume potential credential exposure and initiate password resets for any accounts linked to the site. Organizations are advised to block the domain and its associated IP at the network level and monitor for related indicators of compromise. Given the domain’s high-risk classification and historical use in phishing campaigns, continued vigilance is recommended, particularly for users who may have interacted with the site during its active phase.