user-started[.]wixstudio[.]com

Analysis as of July 20, 2026 indicates that the host user-started.wixstudio.com is currently active and has been classified as a generic phishing site. The domain resolves to the IPv4 address 34.144.206.118. Registration details show the domain was created through Wix.com Ltd., a well‑known website‑building platform, and the authoritative nameservers could not be retrieved (NS_NOT_FOUND). The site has been added to a single security blocklist and is actively blocked by the PhishDestroy filtering service. No additional infrastructure such as extra IPs, CNAME chains, or external hosting providers has been observed. The lack of visible nameserver data and the reliance on a single hosting IP suggest a straightforward deployment typical of low‑complexity phishing operations. At present the investigation cannot confirm the specific content or credential‑capture mechanisms used on the site, as page‑level analysis has not been performed. Defenders should continue to enforce blocklisting for the identified IP address and domain, monitor traffic for connections to 34.144.206.118, and consider adding the domain to broader threat‑intel feeds. Ongoing observation is recommended to detect any expansion of the infrastructure or changes in hosting configuration.