pionexlognn[.]wixstudio[.]com

The domain pionexlognn.wixstudio.com is flagged as an active credential‑harvesting site. Registration records show the domain was created on 17 December 2016 through the Wix Studio platform, indicating the use of a legitimate website‑builder service to obtain a seemingly benign sub‑domain. Infrastructure analysis reveals that the domain resolves to the IP address 34.144.206.118, which is currently listed on one security blocklist.

The domain has been reported to PhishDestroy and is therefore actively blocked by that service. VirusTotal scans show that 11 of 91 antivirus and URL‑reputation engines have generated a detection for the domain, reinforcing the suspicion of malicious intent. No additional public intelligence such as page title, SSL certificate details, or HTTP response codes is available, leaving the exact content of the site unverified.

However, the combination of a recent blocklist entry, multiple vendor detections, and the use of a Wix‑hosted sub‑domain aligns with known tactics for credential‑stealing operations that rely on trusted hosting environments to evade naïve filtering. Defenders should add the domain and its resolving IP to network‑level deny lists, monitor outbound connections to 34.144.206.118, and ensure that email and web filtering solutions reference the current blocklist entry. Continuous re‑scanning of the domain on VirusTotal and other sandbox services is recommended to capture any evolution in the payload or hosting configuration.