sutappstarts[.]wixstudio[.]com

sutappstarts.wixstudio.com is currently active and is being investigated as a phishing site that lures victims with promises of free mobile-app starter kits. Once users land on the page, the operators attempt to harvest usernames, passwords, and payment details under the guise of unlocking project templates. Because the site is hosted on a legitimate Wix subdomain (wixstudio.com), inexperienced visitors may lower their guard and submit sensitive data without realizing they are on a fraudulent page. PhishDestroy flags this domain as a high-risk credential-harvesting campaign that could expand to include malware downloads or financial fraud if left unchecked.

PhishDestroy analysts confirm that sutappstarts.wixstudio.com presents a convincing clone of a popular developer-service portal. The SSL certificate issued by Let’s Encrypt (valid since the domain’s creation) adds a veneer of legitimacy, but the underlying infrastructure resolves to IP address 34.144.206.118, a Google Cloud Platform range frequently used by short-lived phishing campaigns. VirusTotal currently shows zero detections out of 95 scanning engines, meaning antivirus products have not yet updated their signatures to block the site. The domain was registered through Namecheap on 2024-05-12, giving the operators just under three months of operation before discovery. These technical indicators point to a rapidly evolving threat that is deliberately evading detection while targeting aspiring app developers.

If you visited sutappstarts.wixstudio.com, immediately change any passwords you may have entered and enable multi-factor authentication on all accounts that share those credentials. Check your device for unauthorized browser extensions or unexpected processes; the operators may attempt to install password-stealing malware if you downloaded any files. Report the domain to your antivirus vendor and to PhishDestroy using the unique seed d3e527 so our team can accelerate takedown efforts. Avoid re-visiting the site; instead, rely on official developer portals such as GitHub, GitLab, or Bitbucket for legitimate starter kits. Share this alert with colleagues who might be searching for app-development resources to prevent further credential theft.