fact-desktop[.]wixstudio[.]com

This domain, fact-desktop.wixstudio.com, is identified as a credential phishing endpoint targeting users through deceptive login prompts. Analysis indicates no direct association with known drainer kits or specific brand impersonation, though the infrastructure aligns with common phishing tactics observed in cloud-hosted environments. The domain leverages Wix Studio’s legitimate platform for hosting, which may have been exploited to lend superficial credibility to the malicious page before detection. Infrastructure analysis reveals critical technical indicators: the domain is flagged by 13 out of 95 security vendors on VirusTotal, registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. The creation date is April 29, 2026, an anomalous timestamp suggesting potential domain spoofing or pre-registration for malicious use. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and is not listed on Google Safe Browsing at the time of assessment. Technologies detected include Wix, React, Google Cloud, and Google Cloud CDN, with HTTP/3 support, indicating a modern, cloud-based hosting environment. The domain is currently offline, likely taken down following detection and reporting. However, residual risk remains due to the domain’s recent registration and the use of legitimate cloud services to host malicious content. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the exposure window, monitor for unauthorized activity, and verify the legitimacy of any communications from services resembling the phishing attempt. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.