started-desktopapp[.]wixstudio[.]com

The domain started-desktopapp.wixstudio.com is currently flagged as part of a phishing campaign and remains active as of the report date, July 23, 2026. Intelligence indicates that the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Registration details show that the domain was created through Wix.com Ltd., a well‑known website‑builder platform, which suggests the attacker leveraged a legitimate registrar to obtain the hostname. DNS resolution points to the IP address 162.159.143.12; no alternate A or AAAA records were observed, and the nameserver information is unavailable (NS_NOT_FOUND).

No additional data such as Safe Browsing status, Open Threat Exchange entries, SSL certificate details, HTTP response codes, or page title information have been recorded, leaving the content and exact phishing vector unverified. The limited visibility means that while the domain’s malicious intent is confirmed by its blocklist presence and PhishDestroy detection, the specific target brand, lure technique, or credential‑harvesting page cannot be described at this time. Defenders should prioritize adding the domain and its resolving IP to network‑level deny lists and ensure that any outbound connections to the host are blocked.

Continuous monitoring of DNS queries for the domain, as well as periodic re‑scans for any newly published content, is recommended. Correlation with other incidents that reference the same IP or registrar may reveal additional infrastructure used by the threat actor. Until further forensic evidence becomes available, the domain should be treated as a high‑confidence phishing indicator and mitigated accordingly.