stop-desktop[.]wixstudio[.]com

The domain stop-desktop.wixstudio.com has been identified as a credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates the domain is currently offline, though it previously hosted malicious content designed to capture authentication credentials. No specific brand impersonation was confirmed, but the infrastructure aligns with common phishing tactics leveraging cloud hosting providers. Technical indicators reveal the domain was flagged by 12 of 95 security vendors on VirusTotal, with registration through GoDaddy.com, LLC. It resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and utilized a Let's Encrypt SSL certificate. The domain was created on April 25, 2026, and appeared on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. Detected technologies included Wix, React, Google Cloud CDN, and HTTP/3, suggesting a modern, cloud-based phishing operation. Current status confirms the domain is offline, though residual risk remains for users who may have interacted with it during its active phase. Organizations are advised to block the domain and associated IP at the perimeter, review logs for connections to 34.144.206.118, and conduct user awareness training on recognizing credential harvesting attempts. Security teams should monitor for similar domains leveraging Wix Studio or Google Cloud infrastructure, as threat actors frequently reuse hosting providers for phishing campaigns.