pionext-logi[.]wixstudio[.]com

The domain pionext-logi.wixstudio.com has been identified as a credential harvesting phishing site designed to impersonate the Wix Studio platform. Analysis indicates the site was actively collecting login credentials before being taken offline. The specific threat type involves fake login portals targeting users of the Wix service, with the intent to harvest account credentials for unauthorized access. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC, with a creation date of April 24, 2026, suggesting an unusually forward-dated registration. The site resolved to the IP address 34.144.206.118 and employed a Let's Encrypt SSL certificate for encrypted communications. Detection metrics show the domain was flagged by 8 of 95 security vendors on VirusTotal, while appearing on a single security blocklist. The Gridinsoft trust score for this domain was recorded at 0 out of 100, indicating a complete lack of legitimacy. Technologies detected on the site included Wix, React, Google Cloud, Lodash, HSTS, and Google Cloud CDN, which align with the infrastructure commonly used by legitimate Wix Studio pages. As of the latest assessment, pionext-logi.wixstudio.com has been taken offline, rendering the immediate threat inactive. However, organizations and users are advised to remain vigilant for similar phishing attempts. It is recommended to verify domain registration dates for anomalies, monitor for unexpected SSL certificate issuances, and cross-reference domains against multiple threat intelligence feeds. Users who may have interacted with the site should immediately reset their credentials and enable multi-factor authentication on all accounts.