trzoriostart-started[.]wixstudio[.]com

PhishDestroy identifies trzoriostart-started.wixstudio.com as an active generic phishing domain under investigation. The page masquerades as a benign WixStudio subdomain to deceive victims into entering credentials or payment data, leveraging the legitimate hosting platform to lower suspicion. No specific brand or drainer kit has been linked to this campaign yet, but the generic nature suggests opportunistic credential harvesting rather than targeted brand abuse. The threat actor’s reliance on a hosted builder points to a low-cost, high-reach approach aimed at mass compromise rather than sophisticated spear-phishing.

Technical indicators confirm the domain’s recent, malicious deployment. VirusTotal shows 0/95 detections as of the last scan, indicating the infrastructure remains under the radar of most security vendors. The domain resolves to 34.144.206.118, a Google Cloud IP address that hosts multiple dynamic services. The SSL certificate, issued by Let’s Encrypt, adds a veneer of legitimacy, while the WixStudio hosting platform provides a plausible cover for the page’s origins. Creation date and registrar details remain unverified at this stage, but the use of a free website builder suggests minimal upfront costs for the threat actor. Google Safe Browsing (GSB) has not yet flagged the domain, and public blocklist counts are currently zero, reinforcing the stealthy nature of this operation.

This domain is currently active and poses an immediate risk to unwary users. PhishDestroy has flagged the site for takedown coordination with hosting providers and domain registrars. Users are advised to avoid interacting with trzoriostart-started.wixstudio.com and to report any suspicious activity to their security teams. The risk level remains under investigation, but the lack of detections and stealthy infrastructure suggest this phishing kit may expand rapidly. Organizations should update browser and email security policies to block the domain and inspect traffic for similar patterns. Remaining risk is moderate due to the domain’s current low profile and the potential for rapid spread if left unchecked.