begin-indec[.]wixstudio[.]com

The domain begin-indec.wixstudio.com was registered on December 17, 2016 through the Wix Studio registrar and is currently using the NSONE name server cluster (dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, dns4.p08.nsone.net). Infrastructure analysis shows no publicly disclosed IP address, SSL certificate details, or HTTP response codes, indicating that the hosting environment has not been enumerated in open sources. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service, confirming that defenders have identified it as malicious.

VirusTotal records show that 15 of 91 security vendors have flagged the domain, providing independent confirmation of its malicious reputation. No additional evidence such as Safe Browsing status, OTX entries, or page title information is available at this time, and the exact phishing lure or targeted brand has not been disclosed. The lack of visible hosting metadata and the limited number of blocklist entries suggest that the campaign may rely on a low‑profile hosting setup, possibly leveraging Wix's shared infrastructure to evade detection.

Defenders should add begin-indec.wixstudio.com to URL filtering rules, ensure that endpoint protection solutions reference the current VirusTotal detections, and monitor for any new sightings in threat intel feeds. Continuous re‑evaluation is advised, as future analysis may reveal the underlying IP, TLS configuration, or the specific credential‑harvesting page used by the threat actor.