startledzer-com[.]wixstudio[.]com

The domain startledzer-com.wixstudio.com has been identified as a phishing site specifically designed to impersonate Wix Studio, a legitimate website-building platform. This campaign appears to target users by presenting a fraudulent interface mimicking Wix’s branding, likely aiming to harvest credentials or distribute malicious payloads. The domain is currently offline, though prior activity indicates it was actively used in a high-risk phishing operation. Analysis of the domain reveals it was flagged by 12 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The domain resolves to the IP address 34.144.206.118, which is associated with cloud infrastructure. It was registered through GoDaddy.com, LLC, a common registrar for both legitimate and malicious domains. The site appears on three security blocklists, including PhishDestroy and PhishingArmy, and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by Let’s Encrypt, a frequently observed certificate authority in phishing campaigns due to its ease of acquisition. Technologies detected on the domain include Wix, React, Google Cloud, and Google Cloud CDN, suggesting an attempt to replicate the technical stack of legitimate Wix Studio pages. As of the latest assessment, startledzer-com.wixstudio.com has been taken offline, though its prior activity warrants caution. Organizations and users are advised to block the domain and its associated IP (34.144.206.118) at the network level. Security teams should monitor for similar domains registered through GoDaddy or hosted on Google Cloud infrastructure, particularly those impersonating Wix or other web development platforms. End-users should be educated on recognizing phishing attempts, especially those leveraging brand impersonation and cloud-based hosting to appear legitimate.