starplay[.]cc

Analysis of the domain starplay.cc indicates it was operating as a generic phishing site impersonating Wix-hosted infrastructure. The domain, registered on September 10, 2023, through GoDaddy.com, LLC, resolved to the IP address 185.230.63.107, which is associated with AS58182 (Wix.com Ltd.) in the United States. Infrastructure analysis reveals the use of Wix as the primary hosting platform, alongside additional technologies such as Envoy, React, AngularJS, and jQuery, which are consistent with legitimate Wix deployments but may also be exploited for phishing purposes. The domain was flagged by 3 of 95 security vendors on VirusTotal, a low but non-zero detection rate that suggests potential malicious activity.

It was also blocked by PhishDestroy and appeared on at least one security blocklist, further indicating its classification as a threat. The domain returned an HTTP 404 status and a page title of 'Error' at the time of assessment, suggesting it was either taken offline or misconfigured. The SSL certificate, issued by Let's Encrypt (R13), is standard for both legitimate and malicious sites and does not provide conclusive evidence of intent. Nameservers ns4.wixdns.net and ns5.wixdns.net confirm the domain's reliance on Wix's DNS infrastructure, which is commonly abused by threat actors to lend credibility to phishing campaigns.

While the exact content of the site remains unanalyzed due to its offline status, the combination of low vendor detections, blocklist presence, and hosting on Wix infrastructure aligns with known phishing tactics. Defenders should treat this domain as a potential threat vector, particularly for campaigns targeting users of Wix-hosted services. Monitoring for re-emergence or similar domains using Wix's infrastructure is recommended. No specific brand impersonation beyond Wix itself was identified in the available data.