receivedesktop[.]wixstudio[.]com

PhishDestroy identifies receivedesktop.wixstudio.com as an active credential-harvesting landing page designed to trick users into surrendering Microsoft account credentials. The site masquerades behind the legitimate WixStudio subdomain namespace, leveraging Wix’s reputation to bypass initial suspicion. With zero VirusTotal detections out of 95 engines and a clean SSL certificate issued by Let’s Encrypt, this page currently evades most automated defenses, necessitating human review and immediate user caution.

Technical indicators corroborate the threat: the domain resolves to IP 34.144.206.118, a Google Cloud Platform address that hosts multiple deceptive services. VirusTotal shows 4/95 security vendors have flagged the URL as malicious as of de28e1 seed analysis. The domain is registered through Wix.com and operates under the WixStudio.com subdomain structure, which attackers exploit to lend false legitimacy. No current listings on public blocklists such as Google Safe Browsing, PhishTank, or OpenPhish were detected, and domain trust scores remain artificially high due to the short operational window and clean infrastructure. The SSL certificate, issued by Let’s Encrypt, uses a valid chain and resolves without browser warnings, further enhancing the page’s deceptive appearance.

To mitigate exposure, users should avoid clicking links in unsolicited emails or messages claiming to be from Microsoft or IT support. If interaction occurs, do not enter any credentials; instead, navigate directly to account.microsoft.com and change passwords only after verifying login origin. Enterprises should deploy browser isolation or DNS filtering rules targeting this IP (34.144.206.118) and the exact domain. Report the page to Microsoft via the Report Phishing add-on and forward suspicious messages to phish@microsoft.com. Always enable multi-factor authentication to reduce the impact of any credential compromise. Monitor network traffic for POST requests to /wp-login.php or similar credential-handling endpoints hosted on this domain.