en-starts-live[.]wixstudio[.]com

This domain, en-starts-live.wixstudio.com, is identified as a generic phishing site designed to impersonate Wix Studio, a legitimate web development platform. Analysis indicates no explicit crypto drainer or credential-harvesting kit was deployed at the time of detection, though the infrastructure aligns with typical phishing campaigns targeting platform users. The site presented a 404 error page, suggesting either a temporary placeholder or an attempt to evade detection by masking malicious content until activation. No specific brand impersonation beyond Wix Studio itself was observed, but the domain structure mimics legitimate Wix subdomains to deceive targets.

Technical indicators confirm elevated risk: VirusTotal reports 7 detections out of 95 security vendors, resolving to IP address 34.144.206.118. The domain was registered through GoDaddy.com, LLC, with an anomalous creation date of May 02, 2026—likely a typo or deliberate manipulation to obscure registration timelines. Infrastructure analysis reveals the use of Let’s Encrypt SSL certificates, Wix hosting, React framework, and Google Cloud CDN, which are common in both legitimate and malicious deployments. The domain appears on 3 security blocklists and is actively blocked by PhishDestroy, PhishingArmy, and OISD. Google Safe Browsing status was not explicitly provided but is assumed to be flagged given the blocklist presence.

As of the latest assessment, en-starts-live.wixstudio.com has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential vector for future phishing campaigns, particularly given the use of reputable hosting and CDN services to lend credibility. Organizations and users are advised to maintain blocklist enforcement for this domain and monitor for re-emergence under similar subdomain patterns. Additional scrutiny is warranted for domains registered via GoDaddy with anomalous creation dates or those leveraging Wix Studio branding. No further malicious payloads were observed, but the domain’s prior activity justifies continued vigilance.