logon-bitbaycd[.]wixstudio[.]com

Analysis of the domain logon-bitbaycd.wixstudio.com indicates a targeted phishing campaign impersonating BitBay, a cryptocurrency exchange platform. The domain was registered on December 17, 2016, through Wix Studio and currently resolves to the IP address 34.144.206.118. Infrastructure review shows the domain uses four nameservers: dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net, suggesting a stable hosting configuration. As of July 29, 2026, the domain appears on one security blocklist and is flagged by 10 of 91 security vendors on VirusTotal, confirming detection by multiple threat intelligence sources.

The domain name includes the substring 'bitbaycd', which aligns with the known branding of BitBay, a cryptocurrency trading service. No evidence from page titles or content analysis is currently available, so the exact nature of the phishing page (e.g., credential harvesting, wallet drainer, or account takeover) remains unconfirmed. The use of Wix Studio as a hosting platform is notable, as legitimate services rarely use website builders for secure login portals, increasing the likelihood of malicious intent. Defenders are advised to block the domain at DNS and web proxy levels.

The IP address 34.144.206.118 should be monitored for additional malicious domains, as shared hosting infrastructure is commonly reused in phishing operations. While the domain has been active for nearly a decade, the recent detection by security vendors suggests it may have been repurposed for malicious use. No SSL certificate data or HTTP response details are currently available, limiting further assessment of encryption or redirect behavior. Organizations should treat this domain as an active threat and prioritize user education regarding cryptocurrency-themed phishing attempts.