started-terzr-io[.]wixstudio[.]com

PhishDestroy identifies started-terzr-io.wixstudio.com as an active Microsoft 365 credential harvesting scam under investigation for generic phishing. The domain, currently live, resolves to IP 34.144.206.118 and is hosted on WixStudio. No VirusTotal vendor detections have been recorded at this time.

This domain was flagged by 0 of 95 VirusTotal vendors, operates on a Let's Encrypt SSL certificate, and is associated with IP 34.144.206.118. The WixStudio hosting platform is leveraged to deliver a Microsoft 365 login spoof designed to harvest corporate credentials. Technical indicators include a low trust score due to absence of detections, but behavioral analysis confirms active redirection chains targeting enterprise users via deceptive email campaigns. The domain remains unblocked across major security platforms, increasing exposure to potential victims.

The campaign is classified as active and poses a significant risk to organizations relying on Microsoft 365 for email and collaboration. Users should immediately block the domain at the network perimeter and instruct employees to avoid clicking links related to started-terzr-io.wixstudio.com. Security teams are advised to scan for inbound emails referencing this domain and update email filtering rules accordingly. Given the lack of current vendor detection, behavioral monitoring and user awareness training are critical to prevent credential compromise.