startapp-live[.]wixstudio[.]com

This domain is flagged as an elevated-risk credential theft phishing operation targeting users through deceptive login portals. Analysis indicates the infrastructure was designed to harvest authentication credentials, likely for unauthorized account access or follow-on attacks. The domain impersonates legitimate services to exploit user trust in familiar branding. Infrastructure analysis reveals the following technical indicators: 16 of 95 security vendors on VirusTotal detect the domain as malicious. The domain was registered through GoDaddy.com, LLC on April 28, 2026, with an SSL certificate issued by Let's Encrypt. It resolves to IP address 34.144.206.118 and appears on one security blocklist. Gridinsoft assigns a trust score of 0/100, further confirming its malicious nature. Technologies detected include Wix, Envoy, React, Google Cloud, and Google Cloud CDN, suggesting an attempt to mimic legitimate web infrastructure. Mitigation steps for credential theft threats include immediate domain blocking at the network perimeter and endpoint levels. Security teams should review logs for connections to 34.144.206.118 or the domain name to identify potentially compromised systems. Users who may have interacted with this domain should reset credentials for any accounts accessed during the exposure window, prioritizing accounts with elevated privileges or financial access. Multi-factor authentication should be enforced for all critical systems to reduce the impact of stolen credentials. Organizations should monitor for anomalous authentication attempts, particularly from the identified IP or related infrastructure.