home-rabyapps[.]wixstudio[.]com

Analysis indicates that the subdomain home-rabyapps.wixstudio.com remains active as of July 20, 2026 and is associated with a credential‑stealing operation. The domain resolves to the public IP address 34.144.206.118 and is registered through Wix.com Ltd., a platform that offers hosted subdomains for user‑generated sites. No nameserver records are publicly disclosed, which is typical for Wix‑hosted subdomains that rely on the provider’s default DNS configuration. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy threat‑intelligence feed, confirming that at least one vendor has flagged the host as malicious. No additional public indicators such as Safe Browsing listings, Open Threat Exchange entries, SSL certificate details, HTTP status codes, or page titles have been observed, leaving the content of the site unverified. The lack of broader detection coverage creates uncertainty about the scope of the campaign, the specific phishing lure employed, and any associated command‑and‑control infrastructure. Defenders should treat the domain as high‑risk: implement DNS‑level blocking for home-rabyapps.wixstudio.com, add the resolved IP 34.144.206.118 to outbound traffic denial lists, and incorporate the domain into URL filtering policies. Monitoring for email or messaging vectors that reference the subdomain is recommended, as well as periodic re‑evaluation of blocklist sources for any new detections. Given the association with a reputable hosting provider, organizations may also consider contacting Wix.com to request takedown or further investigation of the abusive subdomain.