ssostartin-terxorcdn[.]wixstudio[.]com

This domain, ssostartin-terxorcdn.wixstudio.com, is flagged as a generic phishing infrastructure. VirusTotal records show that the host was submitted to 91 AV engines, and none reported a detection at the time of analysis; the absence of alerts does not imply benign intent. DNS queries return no authoritative name server entries (NS_NOT_FOUND), which is atypical for a legitimate Wix‑hosted site and may indicate a deliberately misconfigured or transient setup. The domain resolves to the IPv4 address 162.159.143.12, an address associated with Wix’s edge network, suggesting the attacker is leveraging the provider’s CDN to host malicious payloads or to obscure origin. Registration data lists Wix.com Ltd. as the registrar, a common choice for both legitimate and compromised sites.

The domain appears on a single external blocklist and is explicitly listed by PhishDestroy as an active phishing vector, confirming that at least one security vendor has observed malicious use. No public SSL certificate details, HTTP response codes, or page title information are available in the current intelligence set, so the content served by the host remains unverified. Likewise, Safe Browsing, OTX, and other reputation services have not published additional indicators. The combination of a clean VirusTotal scan, missing name‑server records, and blocklist presence creates a mixed confidence picture: the infrastructure is active, but the lack of detections may reflect a short‑lived campaign or evasion tactics.

Defenders should treat the domain as hostile until further evidence proves otherwise. Recommended actions include adding the hostname and its resolved IP address to outbound filtering rules, monitoring DNS queries for repeated resolution, and correlating any login or credential submission events with this domain. Continuous re‑scanning on VirusTotal and periodic checks of the IP’s reputation are advised to capture any future detections.