labssuites[.]wixstudio[.]com

The domain labssuites.wixstudio.com was registered on 8 June 2026 through the Wix Studio service. Within weeks of its creation it appeared on a security blocklist and was subsequently flagged by the PhishDestroy sinkhole. VirusTotal records show that 14 of 91 scanned security vendors returned a malicious classification for the domain, indicating a consensus that the site is being used for malicious purposes. The majority of the detections are consistent with a generic phishing campaign, although the specific payload or targeted brand has not been disclosed in the current intelligence set.

The hosting environment is provided by Wix Studio, a legitimate website‑builder platform that can be leveraged by threat actors to host short‑lived phishing pages. No additional infrastructure details such as IP address, autonomous system number, or geographic location have been published, and the SSL certificate status and HTTP response codes have not been observed. Consequently, the full extent of the site’s infrastructure remains uncertain. Defenders should treat labssuites.wixstudio.com as a high‑confidence phishing indicator.

Immediate actions include adding the domain to URL filtering rules, updating internal blocklists, and monitoring outbound traffic for connections to the domain. Because the site is newly created, threat actors may reuse the same Wix‑based sub‑domain pattern for future campaigns; continuous observation of newly registered Wix Studio subdomains is recommended. Organizations employing email security gateways should also consider the domain in their malicious sender reputation checks, as the domain’s presence on a blocklist and multiple vendor detections suggest it may be used in credential‑ harvesting emails. Ongoing analysis should focus on obtaining the hosting IP, TLS certificate details, and any page content once the site becomes reachable, to refine detection signatures and assess whether the phishing campaign targets specific brands or services.