desktops-unknown[.]wixstudio[.]com

This domain, desktops-unknown.wixstudio.com, is assessed as a high-risk phishing site specifically designed to impersonate legitimate Wix Studio authentication portals. Analysis indicates the infrastructure was engineered to harvest credentials or deploy malicious payloads under the guise of a trusted platform, with the page title '404 Error: Page Not Found | Wix Studio' serving as a potential decoy or fallback mechanism after initial compromise attempts. The threat type aligns with brand impersonation phishing, targeting users expecting legitimate Wix Studio services. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 34.144.206.118 hosted on Google Cloud infrastructure, utilizing technologies including Wix, React, Lodash, HSTS, and Google Cloud CDN with HTTP/3 support. Security vendors flagged this domain with 12 detections out of 95 on VirusTotal, while three major blocklists (PhishDestroy, PhishingArmy, and OISD) have actively blocked it. The domain was registered through GoDaddy.com, LLC with a suspicious creation date of May 20, 2026—three years in the future—indicating potential domain age manipulation. The SSL certificate issued by Let's Encrypt appears valid but expired, and Gridinsoft assigned a trust score of 0/100, reinforcing the malicious classification. The domain is currently offline, suggesting either takedown or operational pause. Mitigation against this brand impersonation phishing threat requires immediate action from both end users and security teams. Users should verify domain authenticity by checking for official Wix Studio subdomains and HTTPS certificate details before entering credentials. Security teams should implement DNS-based blocking for the domain and its associated IP 34.144.206.118, while monitoring for similar patterns including future-dated domain registrations and Wix-related subdomains on non-Wix infrastructure. Credential rotation should be enforced for any accounts potentially exposed to this phishing attempt, with particular attention to accounts associated with Wix Studio or Google Cloud services. Network monitoring should focus on outbound connections to Google Cloud IPs and HTTP/3 traffic patterns that may indicate similar phishing infrastructure.