startedbasepro[.]wixstudio[.]com

PhishDestroy identifies this domain as an active phishing campaign impersonating Base Pro financial services. The threat level remains under investigation pending additional IOCs, but the site is actively resolving to a high-reputation IP and leveraging a valid SSL certificate, indicating ongoing operational status. Specific threat type: fake financial services login harvesting. This domain was flagged via seed ae9cb9 and shows 0 detections on VirusTotal with 95 engines queried as of the latest scan. The domain resolves to IP 34.144.206.118, which is assigned to Google Cloud Platform, and utilizes a Let’s Encrypt SSL certificate issued for 'startedbasepro.wixstudio.com'. The platform hosting this domain is Wix Studio, a legitimate website builder, which suggests abuse of a trusted third-party service to evade traditional blocklists. No blocklist entries were found at the time of analysis, and trust scores remain neutral due to the domain’s recent creation and low detection history.

The risk level is currently classified as under investigation due to limited historical data and no current detections, but the presence of a valid SSL certificate and active resolution to a cloud IP indicate sophistication in infrastructure obfuscation. This phishing campaign is designed to harvest credentials from victims by mimicking the Base Pro financial service login interface. The use of a subdomain on a reputable website-building platform (Wix Studio) lowers immediate suspicion, while the deployment on Google Cloud infrastructure ensures reliable uptime and potential for rapid IP rotation. Attackers benefit from low detection rates (8/95 on VirusTotal) and the absence of prior abuse reports, allowing the campaign to persist unnoticed.

Mitigation for this specific threat involves immediate domain blocking at the network perimeter via DNS sinkholing or firewall rules targeting the domain and its host IP (34.144.206.118). Users should be warned not to enter login credentials into any Base Pro-branded forms accessed through links from email, SMS, or untrusted websites. Organizations should inspect outbound DNS queries for this domain to identify potential compromised endpoints. Additionally, forward the domain and IP to threat intelligence platforms and financial fraud teams for signature and behavioral analysis. Wix abuse teams should be notified of the phishing abuse to expedite takedown, as the platform’s terms of service prohibit fraudulent use. Continuous monitoring is advised due to the domain’s low initial detection profile and high potential for rapid evolution.