ldgrlivedesktop[.]wixstudio[.]com

PhishDestroy identifies ldgrlivedesktop.wixstudio.com as an active fake live desktop phishing domain designed to deceive users into entering credentials under the guise of accessing a remote desktop environment. This domain mimics legitimate remote access services to harvest login details, session tokens, or sensitive data under false pretenses. The infrastructure hosting this domain resolves to IP address 34.144.206.118, which is associated with cloud-based web hosting, a common tactic used by threat actors to rapidly deploy and rotate phishing pages while evading traditional blocklists. The domain employs a Let's Encrypt SSL certificate, leveraging the appearance of legitimacy to further deceive potential victims. This domain exhibits multiple red flags confirmed through automated analysis. VirusTotal currently reports 0 out of 95 antivirus engines detecting any malicious content, indicating this threat has not yet been widely flagged despite active deployment. The domain operates under Wix’s studio hosting platform, which allows threat actors to create and host phishing pages under seemingly reputable domains. Technical indicators include the IP address 34.144.206.118 (ASN 15169, Google LLC), which is known for hosting dynamic and potentially malicious web content. While the exact creation date is not publicly available, the use of Wix’s subdomain structure suggests recent deployment, likely within the last few months. As of this report, the domain remains under active investigation and has not yet been listed on major blocklists, increasing the risk of exposure to unsuspecting users. Users who have visited ldgrlivedesktop.wixstudio.com should immediately check their accounts for unauthorized access, particularly those used to log in via this domain. If credentials were entered, change passwords immediately and enable multi-factor authentication on all related accounts. Report the domain to your IT security team or through your organization’s phishing reporting channels. Avoid interacting with any prompts or requests for personal information on this domain. Monitor financial accounts and sensitive data for signs of compromise, such as unauthorized logins or transactions. For further analysis or to report additional sightings, visit the PhishDestroy threat intelligence portal and reference seed identifier f09736 for tracking and correlation.