started-logonlive[.]wixstudio[.]com

PhishDestroy identifies started-logonlive.wixstudio.com as a live phishing campaign mimicking Microsoft account login pages to steal credentials. The lure impersonates a compromised Microsoft 365 session and is hosted on WixStudio’s infrastructure to appear legitimate. This domain currently shows zero detections on VirusTotal despite active credential harvesting activity. This domain was flagged by PhishDestroy’s automated pipeline using seed aeb975 and is resolving to IP 34.144.206.118. The SSL certificate is issued by Let’s Encrypt, which is commonly abused in phishing due to automated issuance. WixStudio subdomains are frequently leveraged in credential phishing due to their trusted domain reputation and ease of rapid deployment. If you visited started-logonlive.wixstudio.com, assume your Microsoft credentials may have been compromised. Immediately change your Microsoft account password and enable multi-factor authentication. Review recent sign-in activity at account.microsoft.com/activity and revoke unknown sessions. Consider using a password manager to detect lookalike domains. Report the domain to Microsoft via their Phishing Protection portal and local CERT teams if in a corporate environment.