logon-appsnaddx[.]wixstudio[.]com

This domain, logon-appsnaddx.wixstudio.com, is currently flagged as an active credential-harvesting phishing site. Infrastructure analysis reveals it is hosted on Wix's platform, registered through Wix.com Ltd., and resolves to the IP address 162.159.143.12. The absence of nameservers (NS_NOT_FOUND) is atypical for legitimate Wix-hosted domains, which may indicate an attempt to obscure tracking or evade detection. The domain appears on at least one security blocklist, specifically PhishDestroy, which has already classified it as malicious. No additional detection vendors, Safe Browsing results, or threat intelligence feeds (e.g., OTX) are currently listed in the available evidence. Defenders should note that the domain remains operational as of July 21, 2026, with no indication of takedown or remediation efforts. The hosting infrastructure (Wix Studio) is commonly abused for phishing due to its ease of deployment and low cost, though this does not inherently implicate Wix as complicit. The resolved IP (162.159.143.12) is part of Cloudflare's network, which is frequently leveraged to mask the true origin of malicious sites. No SSL certificate details, HTTP response codes, or page content analysis (e.g., page title, brand impersonation) are provided in the available data, limiting further assessment of the phishing kit or targeted brand. Recommended actions include immediate blocking of the domain and IP at the network perimeter, monitoring for internal access attempts, and submitting the domain to additional threat intelligence platforms for broader detection. If internal logs reveal user interaction with this domain, credentials entered should be considered compromised and reset. Given the lack of nameserver records, defenders may also investigate whether this domain is part of a larger campaign using similar infrastructure patterns. Further analysis of the resolved IP and hosting provider logs (if accessible) could yield additional indicators of compromise.