# PhishDestroy threat dossier — startioapp-trazor.wixstudio.com ================================================================ Fetched: 2026-07-28 16:37:25 UTC Canonical: https://phishdestroy.io/domain/startioapp-trazor.wixstudio.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 45/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 162.159.143.12 (US, San Francisco) ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Hosting org: AS13335 Cloudflare, Inc. Registrar: Wix.com Ltd. Nameservers: NS_NOT_FOUND Page title: Trézor.io/Start — Starting Up™ Your Device | Trezor®® HTTP response: 404 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-22 Status: INVALID chain Fingerprint: 4d824d023de01f229e601938edcdb7020802d167c0d85fac21c644cf194c9450 Subject Alternative Names (related infrastructure — often same operator): - wixstudio.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-25 09:04:39 UTC (by PhishDestroy tracker) Last verified: 2026-07-28 16:20:28 UTC Neutralised: 2026-07-25 12:28:36 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f9816-4c44-705e-90a2-2ebc51e77329/ Wayback Machine: https://web.archive.org/web/*/startioapp-trazor.wixstudio.com crt.sh CT logs: https://crt.sh/?q=%25.startioapp-trazor.wixstudio.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=startioapp-trazor.wixstudio.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/startioapp-trazor.wixstudio.com URLhaus: https://urlhaus.abuse.ch/host/startioapp-trazor.wixstudio.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-25 09:05:16 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] startioapp-trazor.wixstudio.com – Phishing Site Alert The domain startioapp-trazor.wixstudio.com was registered through Wix.com Ltd., a legitimate website-building service that provides sub-domains under the wixstudio.com suffix. The domain resolves to the IP address 162.159.143.12, which belongs to the Cloudflare network and is commonly used as a reverse-proxy for many hosted sites. No nameserver records were returned (NS_NOT_FOUND), suggesting that the authoritative DNS information is either hidden behind Wix’s internal DNS management or not publicly resolvable. The domain is currently listed on a single security blocklist and has been actively blocked by the PhishDestroy feed, indicating that at least one security vendor has observed malicious use. VirusTotal reports that the domain was scanned by 91 vendors, none of which raised a detection at the time of analysis; this absence of detections does not constitute evidence of benign behavior and may reflect the limited visibility of the content at the time of scanning. The threat classification in the intelligence is "generic phishing," and the overall status is marked as active and under investigation. No additional data such as SSL certificates, HTTP response codes, page titles, or content signatures were supplied, leaving the exact nature of the phishing payload unknown. Consequently, the primary observable indicators are the registrar (Wix.com Ltd.), the Cloudflare-hosted IP, the lack of public nameserver records, and the presence on the PhishDestroy blocklist. Defenders should consider adding startioapp-trazor.wixstudio.com to URL filtering and DNS-based deny lists, monitor outbound connections to the associated IP, and enforce strict email gateway rules that flag messages containing this domain. Continuous re-scanning with reputation services is recommended, as the domain may evolve or become associated with additional malicious infrastructure. Until further forensic evidence is obtained, precautionary blocking remains the most effective mitigation. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: b3a28e80142aa4908d146d48f8f4cfdf TLS cert SHA-256: 4d824d023de01f229e601938edcdb7020802d167c0d85fac21c644cf194c9450 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/startioapp-trazor.wixstudio.com/ JSON API: https://api.destroy.tools/v1/check?domain=startioapp-trazor.wixstudio.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 211,986 domains (86,426 alive under monitoring, 124,530 confirmed takedowns/dead). Site: https://phishdestroy.io