started-ndaax[.]wixstudio[.]com

PhishDestroy identifies started-ndaax.wixstudio.com as an active phishing domain operating under a WixStudio subdomain to distribute fraudulent NDA documents. The site impersonates legitimate business correspondence to trick recipients into downloading malicious payloads or surrendering sensitive information. Threat actors leverage reputable hosting providers and Let’s Encrypt SSL certificates to increase credibility and evade early detection, making this campaign particularly deceptive for unsuspecting users. This domain resolves to IP 34.144.206.118 and currently shows zero detections out of 95 VirusTotal scanners, indicating a newly deployed or rapidly evolving threat. While the hosting infrastructure is hosted on Google Cloud (34.144.206.0/24), the domain itself is registered through Wix and remains unlisted on major blocklists as of the latest intelligence. The SSL certificate issued by Let’s Encrypt adds a false sense of security, obscuring the malicious intent behind the site. The use of a Wix subdomain (.wixstudio.com) further complicates takedown efforts due to the legitimate reputation of the parent domain. If you visited started-ndaax.wixstudio.com or received a suspicious NDA-related email referencing this domain, immediately isolate the device from your network, scan for malware using updated antivirus tools, and review any downloaded files in a sandbox environment. Do not enter credentials or personal information on the page. Report the domain to your email provider, network administrator, or PhishDestroy via the unique seed identifier 846bc4 for inclusion in active threat feeds. Avoid reopening the link or attachment and warn colleagues who may have received similar communications.