ndaix-en[.]wixstudio[.]com

Analysis of the domain ndaix-en.wixstudio.com, first observed on June 08, 2026, indicates that it is being used in a generic phishing campaign. The domain is hosted via the Wix Studio platform, which provides a turnkey website builder service. VirusTotal records show that 11 of 91 scanned security engines have flagged the domain as malicious, reflecting a moderate level of detection across the security community. The domain also appears on a single external blocklist and has been proactively blocked by the PhishDestroy sink‑hole service, confirming that at least one defensive organization has identified it as a threat.

No publicly available information about the underlying IP address, autonomous system number, or geographic location has been disclosed in the current intelligence set, and no SSL certificate details or HTTP response codes have been reported. Likewise, the page title and any observed brand impersonation have not been captured, limiting the ability to describe the precise visual lures employed. The lack of additional context means that the full scope of the campaign—such as the targeted audience, credential‑stealing mechanisms, or potential data exfiltration pathways—remains uncertain. Given the available evidence, defenders should treat ndaix-en.wixstudio.com as a high‑confidence indicator of phishing activity.

Recommended mitigation steps include adding the domain to network and endpoint blocklists, updating URL filtering policies, and monitoring DNS logs for queries to the domain. Organizations using Wix Studio for legitimate purposes should verify that no unauthorized subdomains have been created under their account. Continuous re‑evaluation is advised, as further analysis may reveal additional infrastructure elements or malicious payloads associated with this domain.