starts-live[.]wixstudio[.]com

PhishDestroy identifies starts-live.wixstudio.com as an active fake-login phishing domain leveraging WixStudio’s hosting platform to distribute a crypto drainer kit. The page impersonates a login portal designed to harvest cryptocurrency wallet credentials and initiate unauthorized transfers. WixStudio hosting is abused to lend false legitimacy to the threat, increasing user deception. No affiliation with Wix is implied or confirmed; the site is an attacker-controlled facade. This domain presents multiple concrete technical indicators. VirusTotal flags the domain with a 5/95 detection score from security vendors, while PhishArmy and OpenPhish independently block it. It resolves to IP 34.144.206.118 and uses a valid Let’s Encrypt SSL certificate. The domain has no publicly listed creation date yet resides on a Google-blocked IP, indicating prior abuse. Two independent blocklists have flagged this domain, confirming its active phishing campaign status. Investigation status shows the domain remains active and is actively distributing phishing payloads. PhishDestroy maintains real-time monitoring and feeds updates to blocklists, including Google Safe Browsing. While response actions have slowed propagation, the domain remains accessible and poses elevated risk to visitors. Users are advised to avoid interaction and verify any Wix-hosted login pages using PhishDestroy before entering credentials.