started-usen-desktop[.]wixstudio[.]com

Analysis conducted on July 23, 2026 identifies started-usen-desktop.wixstudio.com as an active phishing domain hosted on Wix.com Ltd infrastructure. The domain resolves to IP address 162.159.143.12, an endpoint that currently returns no valid nameserver records (NS_NOT_FOUND). This configuration is atypical for legitimate Wix-hosted sites, which normally retain default Wix nameservers. At the time of investigation, the domain appears on one security blocklist and is actively blocked by PhishDestroy, though no additional vendor detections or Safe Browsing flags are documented. The registrar of record is Wix.com Ltd, and the domain remains operational, serving content that has not yet been classified by automated crawlers or sandbox systems.

Infrastructure analysis reveals the domain is part of Wix Studio’s subdomain space, which allows users to create custom subdomains under wixstudio.com without requiring separate DNS delegation. This feature is frequently exploited by threat actors to rapidly deploy phishing pages without triggering registrar-level alerts. The absence of nameserver records suggests the subdomain may have been created recently or configured improperly, though Wix’s platform does not mandate public DNS visibility for subdomains. No SSL certificate details, HTTP response codes, or page titles are currently available, limiting further assessment of the site’s content or intended target.

Defenders are advised to treat this domain as suspicious based on its blocklist presence and atypical nameserver configuration. Network-level blocking at 162.159.143.12 or via domain-based rules is recommended pending further analysis. Security teams should monitor for additional detections or brand impersonation patterns, as the current dataset does not specify whether the site mimics a corporate login, financial service, or other high-value target. No evidence links the domain to known phishing kits or threat actor infrastructure at this time.