startapps-ldgro[.]wixstudio[.]com

This domain, startapps-ldgro.wixstudio.com, is identified as a generic phishing infrastructure leveraging the Wix Studio platform to host fraudulent credential harvesting pages. Analysis indicates the site mimics legitimate login portals, likely targeting corporate or personal accounts to capture usernames, passwords, and potentially multifactor authentication tokens. No specific brand impersonation or drainer kit signatures were confirmed in the available telemetry, though the use of Wix’s subdomain structure suggests an attempt to exploit the platform’s free hosting for rapid deployment and evasion of initial scrutiny. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 13 out of 95 security vendors on VirusTotal, indicating broad detection despite its recent creation. It is registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, a Google Cloud-hosted endpoint. The domain was created on June 15, 2026, though this date may reflect a typo or spoofed registration metadata. The SSL certificate is issued by Let’s Encrypt, providing encrypted HTTPS connections to lend an appearance of legitimacy. The page currently returns a 404 error, suggesting either takedown or temporary deactivation. The domain appears on three security blocklists: PhishDestroy, PhishingArmy, and OISD, further corroborating its malicious classification. Current status shows the domain as offline, likely due to platform-level intervention by Wix or external takedown requests. However, residual risk persists due to the potential for rapid redeployment under a new subdomain or alternative hosting provider. Organizations are advised to block the domain and its resolving IP at the network perimeter, monitor for similar Wix-hosted subdomains with anomalous creation dates, and implement real-time phishing detection mechanisms. End users should verify the authenticity of login pages, particularly those hosted on free subdomain services, and report suspicious URLs to their security teams for further analysis.