coin-li[.]wixstudio[.]com

This domain, coin-li.wixstudio.com, was created on 17 December 2016 through the Wix Studio registration service. The authoritative name servers are dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net, indicating hosting on the NSONE network. VirusTotal records show that 13 of 91 scanned security vendors flagged the domain, confirming malicious classification.

The domain appears on a single security blocklist and is actively listed by PhishDestroy, providing additional evidence of phishing use. The available intelligence does not include HTTP response codes, SSL certificate details, or page title information, so the exact content served by the site remains unverified. However, the combination of a recent blocklist entry, multiple vendor detections, and the presence on a dedicated phishing takedown service strongly suggests the domain is being used for generic phishing campaigns.

Defenders should add coin-li.wixstudio.com to URL filtering and endpoint allow‑list exclusions, monitor DNS queries for the listed NSONE name servers, and ensure that any inbound or outbound traffic to the domain is blocked at the perimeter. Continuous re‑scanning with VirusTotal or similar multi‑engine services is recommended to capture any changes in detection rates. Organizations that rely on Wix‑hosted subdomains for legitimate services should verify the authenticity of any communications that reference this domain before disclosing credentials.