started-simpleswp[.]wixstudio[.]com

PhishDestroy identifies started-simpleswp.wixstudio.com as a WordPress-themed phishing domain under active investigation for credential harvesting.

This domain poses a high-risk threat, specifically designed to mimic WordPress login interfaces and deceive users into submitting their credentials. Key technical indicators include an SSL certificate issued by Let's Encrypt, resolving to IP 34.144.206.118, and currently showing 3/95 VirusTotal detections, suggesting it has evaded immediate automated detection. The domain is hosted on WixStudio infrastructure, adding a layer of legitimacy that may mislead users into trusting the page. While the risk level remains classified as under_investigation, the active status and targeted impersonation of a widely used CMS platform like WordPress demand heightened vigilance.

Technical analysis of started-simpleswp.wixstudio.com reveals a sophisticated approach to phishing by leveraging a trusted hosting platform (WixStudio) to host malicious content. The domain’s association with Let’s Encrypt ensures encrypted connections, which may lull users into a false sense of security. VirusTotal’s current detection rate of 3/95 is not uncommon for newly deployed phishing domains, as threat actors frequently rotate infrastructure to avoid blacklisting. The IP address 34.144.206.118 is part of Google Cloud’s infrastructure, which could be leveraged to bypass traditional IP-based blocking mechanisms. No known entries in public blocklists or DNS-based threat intelligence feeds were detected at the time of analysis, underscoring the importance of behavioral detection over reliance on static reputation services.

To mitigate risks associated with this phishing domain, users are advised to avoid interacting with any links or forms hosted on started-simpleswp.wixstudio.com, particularly those mimicking WordPress login pages. Organizations should implement email filtering rules to block unsolicited links to wixstudio.com subdomains and educate employees on verifying the authenticity of login pages by checking the domain URL and SSL certificate details. Domain administrators can proactively block the IP 34.144.206.118 and monitor network traffic for connections to this address. Additionally, users should enable multi-factor authentication (MFA) on their WordPress accounts to reduce the impact of credential theft, ensuring that even if login details are compromised, unauthorized access is prevented.