publicstartcom[.]wixstudio[.]com

PhishDestroy analysts are investigating publicstartcom.wixstudio.com, a live phishing domain impersonating Microsoft 365 to harvest corporate login credentials. The campaign remains active as of the latest scan and is currently under active investigation by our threat intelligence team. Microsoft branding is being abused to deceive end users into entering their corporate credentials into a fraudulent login portal hosted on this infrastructure.

This domain was flagged by zero of 95 VirusTotal vendors, indicating it has not yet been widely detected by antivirus engines. The domain resolves to IP address 34.144.206.118 and is secured with a Let’s Encrypt SSL certificate. WixStudio is confirmed as the hosting platform, with the subdomain created on an undetermined date. The infrastructure shows no current blocklist presence and maintains neutral trust scores across available reputation services. Despite low detection and reputation scores, the domain is actively serving a spoofed Microsoft 365 login page designed to harvest corporate credentials.

As this domain remains active and represents a targeted credential harvesting threat, organizations are strongly advised to block traffic to publicstartcom.wixstudio.com at the firewall and DNS level. Users should be warned not to interact with any links or attachments from this domain. Security teams should inspect email and web traffic for signs of Microsoft 365 credential phishing and consider deploying multi-factor authentication (MFA) controls to mitigate the risk of account compromise. Continuous monitoring of this domain is recommended as the investigation progresses.