platsform-livestarts[.]wixstudio[.]com

PhishDestroy identifies the domain platsform-livestarts.wixstudio.com as an active generic phishing campaign impersonating login portals. This domain, resolved to 34.144.206.118, is currently leveraging a fake login scheme to harvest credentials from unsuspecting users. The infrastructure aligns with crypto drainer kits, though no specific kit variant has been confirmed at this stage. The threat is elevated due to its ongoing activity and presence in phishing distribution channels targeting cryptocurrency and web3 users.

Technical analysis reveals this domain is hosted on WixStudio’s platform with an SSL certificate issued by Let’s Encrypt. Registration details remain obscured, as is common with malicious WixStudio subdomains. The domain first appeared in threat feeds in early August 2024 and currently registers a VirusTotal detection score of 5 out of 95 security vendors. It resolves to IP 34.144.206.118 via a shared hosting environment. Google Safe Browsing (GSB) does not flag the domain, but it is blocked by PhishingArmy and OISD, among others, totaling 2 active blocklist detections. The domain exhibits characteristics of a fast-flux setup, rapidly cycling subdomains to evade static defenses.

This phishing domain remains active as of August 2024 despite its presence on multiple blocklists. Immediate user action is recommended to avoid credential harvesting, especially among cryptocurrency users. PhishDestroy continues to monitor the domain and has flagged it for take-down requests at both Wix and Let’s Encrypt. However, the risk remains elevated due to its current availability and the absence of universal blocking by major browsers or registrars. Users are urged to verify all URLs via PhishDestroy and report suspicious links immediately.