startin-tangam[.]wixstudio[.]com

This domain, startin-tangam.wixstudio.com, is identified as a credential theft phishing operation. Analysis indicates the infrastructure was designed to mimic legitimate login portals, likely targeting users with fraudulent authentication prompts to harvest credentials. No specific brand impersonation or crypto drainer kit signatures were confirmed, but the domain’s structure and detected technologies suggest a focus on credential acquisition. The page title, "404 Error: Page Not Found | Wix Studio," appears to be a post-compromise artifact, as the site was operational prior to takedown. Infrastructure analysis reveals the domain resolved to IP address 34.144.206.118, hosted on a platform utilizing Wix, React, and Google Cloud technologies. The SSL certificate was issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. The domain is registered through GoDaddy.com, LLC, and is flagged by 11 out of 95 security vendors on VirusTotal. It appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. No Google Safe Browsing (GSB) record was available at the time of analysis, suggesting either recent registration or evasion techniques. The domain is currently offline, likely due to hosting provider intervention or registrar enforcement. While this mitigates immediate risk, the infrastructure may resurface under a different domain or subdomain. Remaining risks include potential reuse of the same registrar, hosting provider, or SSL certificate authority for future phishing campaigns. Organizations are advised to monitor for similar patterns, such as Wix-hosted subdomains with anomalous page titles or sudden 404 errors post-compromise. Blocklist integration and endpoint protection rules should be updated to include this domain’s indicators of compromise (IoCs).