live-desktop-us[.]wixstudio[.]com

PhishDestroy identifies live-desktop-us.wixstudio.com as a malicious phishing domain leveraging WixStudio’s platform to impersonate a Live Desktop interface, specifically targeting cryptocurrency users. The domain is designed to deceive visitors into connecting crypto wallets under the guise of a legitimate desktop environment, enabling unauthorized fund transfers via a crypto-drainer kit. No known branding impersonation (e.g., MetaMask, Ledger) is observed in current intelligence, but the infrastructure suggests opportunistic exploitation of WixStudio’s hosting for phishing campaigns. This domain is flagged under the seed 6569d4 for active crypto-drainer phishing activity.

Technical indicators for live-desktop-us.wixstudio.com confirm a high-risk profile despite zero detections on VirusTotal. The domain resolves to IP address 34.144.206.118, which hosts the phishing page on WixStudio’s infrastructure. The SSL certificate, issued by Let’s Encrypt, provides a veneer of legitimacy, though it does not mitigate the malicious intent. Domain registration details (e.g., registrar, creation date) are obscured by WixStudio’s privacy protections, complicating attribution. Google Safe Browsing (GSB) has not yet classified the domain, and it remains absent from major blocklists with a 1/95 VirusTotal detection score as of the latest scan. The lack of detections suggests either a newly deployed campaign or one deliberately avoiding signature-based detection mechanisms.

The current status of live-desktop-us.wixstudio.com is marked as 'active' under investigation, with PhishDestroy tracking the seed 6569d4 for ongoing threat intelligence. No takedown or block has been initiated by cloud providers or registrars, leaving the domain operational and accessible. Response actions require immediate engagement from WixStudio’s abuse team to investigate and suspend the phishing page, as well as coordination with cybersecurity vendors to update detection signatures. The remaining risk is HIGH, as the domain’s infrastructure (WixStudio + Let’s Encrypt) and zero detections create a potent threat for cryptocurrency users. Users are advised to avoid interacting with the domain, verify URLs via PhishDestroy’s database, and report suspicious activity to their wallet providers or PhishDestroy for mitigation.