started-trxor[.]wixstudio[.]com

PhishDestroy identifies started-trxor.wixstudio.com as an active cryptocurrency scam landing page designed to deceive users into depositing digital assets. Security researchers detected this domain distributing fraudulent investment opportunities under the guise of a legitimate platform. The threat remains operational as of the latest analysis, actively targeting unsuspecting users with false promises of high returns in crypto trading or investment schemes.

This domain was flagged by 0 of 95 VirusTotal vendors and resolves to IP address 34.144.206.118, which hosts the malicious content on the WixStudio platform. The SSL certificate, issued by Let's Encrypt, provides a superficial layer of authenticity to mislead visitors. Despite its low detection rate, the site’s use of a legitimate hosting provider (WixStudio) does not mitigate the active threat it poses to potential victims. The infrastructure remains under investigation to determine additional indicators of compromise or associated malicious domains.

Given the current status of this domain as an active cryptocurrency scam, users are strongly advised to avoid accessing started-trxor.wixstudio.com entirely. If encountered, individuals should report the URL to their cybersecurity team or relevant authorities, such as the Anti-Phishing Working Group (APWG). Organizations are encouraged to update firewall rules and DNS blocklists to prevent internal access to this domain. Additionally, users who may have interacted with this site should scan their devices for malware and review any connected cryptocurrency wallets for unauthorized transactions.