homestart-extensions[.]wixstudio[.]com

PhishDestroy identifies an active phishing campaign targeting HomeStart Extensions users via the domain homestart-extensions.wixstudio.com. This site is categorized as a generic phishing threat and is currently active, posing a direct risk to visitors seeking legitimate HomeStart Extensions services.

The domain homestart-extensions.wixstudio.com resolves to IP 34.144.206.118 and is secured with a Let’s Encrypt SSL certificate. As of the latest scan, this domain was flagged by 8 of 95 VirusTotal vendors, indicating it has not yet been widely detected by automated defenses. The domain is hosted on Wix’s platform (wixstudio.com), which may be abused to lend false legitimacy to the fraudulent site. While specific creation date and blocklist metrics are under further analysis, the absence of detections highlights a critical detection gap that attackers are actively exploiting.

This campaign remains active and represents an immediate threat to users who may mistake the spoofed site for the official HomeStart Extensions platform. Users are strongly advised to avoid clicking links to homestart-extensions.wixstudio.com and to verify the authenticity of any HomeStart Extensions-related site by visiting the official domain (homestart.gov.au or homestart.extensions.gov.au) directly. Organizations and individuals should report this domain to their security teams and consider updating network blocklists to include IP 34.144.206.118. Further investigation is ongoing with seed ID 9ae474 to uncover additional infrastructure and potential payloads associated with this campaign.