starts-ldggrwllet[.]wixstudio[.]com

Analysis of the domain starts-ldggrwllet.wixstudio.com indicates it is actively leveraged in a credential‑harvesting campaign. The site was registered through the Wix Studio platform on 17 December 2016, suggesting the attacker is exploiting a legitimate website‑building service to host malicious pages. The domain is currently listed on one public security blocklist and has been blocked by the PhishDestroy filtering service, confirming that defensive feeds consider it malicious.

VirusTotal scans show that 12 of 91 scanned security engines flag the domain, providing independent corroboration of its malicious nature. The limited detection footprint—only one blocklist entry and a modest number of vendor detections—implies that the infrastructure may be low‑profile or that the campaign is relatively recent, leaving many attribution details unknown. No public information is available regarding the hosting IP address, SSL certificate, HTTP response codes, or page title, and the site’s content has not been publicly disclosed, so the exact phishing vector and targeted brands remain uncertain.

Defenders should continue to block the domain at perimeter filters, update URL reputation lists, and monitor for any related sub‑domains or newly registered Wix‑based sites that exhibit similar patterns. Network traffic to the domain should be logged and, where possible, redirected to a sinkhole for further forensic analysis. Incident response teams encountering login attempts or credential submissions to this host should treat them as compromised and enforce credential resets for affected accounts.