oauth-laceextension[.]wixstudio[.]com

Analysis indicates that oauth-laceextension.wixstudio.com is currently active and resolves to the IP address 162.159.143.12, which belongs to the Wix.com hosting infrastructure. The domain registration is listed under Wix.com Ltd., a legitimate web‑site builder that frequently provides sub‑domains for user‑generated content. Nameserver information is not available in the current data set. The domain appears on a single security blocklist; PhishDestroy has listed it as malicious and is actively blocking traffic to the host.

VirusTotal has processed the domain through 91 antivirus and URL scanning engines, and none of the engines returned a detection at the time of analysis. No additional detections have been reported by other public threat‑intelligence feeds such as OTX or Google Safe Browsing, and no SSL certificate details, HTTP response codes, or page‑title metadata are present in the available intelligence. The limited observable footprint suggests that the infrastructure may rely on the shared Wix hosting environment, which can complicate takedown efforts because the underlying service is used by many legitimate sites. Uncertainty remains regarding the specific phishing payload, the targeted brand, and any credential‑harvesting mechanisms, as no page‑level analysis has been disclosed.

Defenders should continue to monitor network traffic for connections to 162.159.143.12, enforce blocklist rules that include PhishDestroy entries, and consider adding the domain to internal URL filtering policies. Because the registrar is a reputable provider, any remediation that involves domain suspension should be coordinated with Wix.com Ltd. to ensure that legitimate customer sites are not inadvertently affected. Ongoing vigilance is advised, and any future observations such as SSL certificate changes, HTTP status variations, or additional vendor detections should be incorporated into the risk assessment.