trzstartedio[.]wixstudio[.]com

PhishDestroy identifies trzstartedio.wixstudio.com as a fraudulent domain under active investigation for phishing campaigns. This domain leverages WixStudio's subdomain hosting to obfuscate its malicious intent, currently resolving to IP 34.144.206.118 with a valid Let's Encrypt SSL certificate. The absence of detections (0/95) on VirusTotal suggests this domain is either newly deployed or employs evasion techniques to bypass traditional security measures. While the SSL certificate adds superficial legitimacy, the underlying infrastructure remains untrusted, warranting immediate scrutiny. The domain's technical profile reveals minimal observable infrastructure. With zero detections across 95 security vendors, it remains undetected despite its active status. The IP address (34.144.206.118) belongs to Google Cloud's infrastructure, which threat actors frequently exploit for low-cost, high-availability hosting. The WixStudio subdomain structure further complicates attribution, as legitimate services often share this hosting environment. Given the lack of historical blocklist entries or reputation data, this domain poses an elevated risk of credential harvesting or malware distribution. Users who have encountered this domain should assume potential exposure. Do not enter any credentials or download files from this site. If visited accidentally, clear browser cache and cookies, then run a full antivirus scan. Report the domain to your security team and consider blocking IP 34.144.206.118 at the network perimeter. Organizations should monitor for unusual outbound traffic to this IP, as it may indicate compromised endpoints. This advisory will be updated as new intelligence emerges, with seed ee6d68.