webstart-m-atom[.]wixstudio[.]com

On July 24, 2026 the domain webstart-m-atom.wixstudio.com was observed as an active malicious endpoint associated with generic phishing. The domain is registered through Wix.com Ltd., a widely used website‑builder service, and resolves to the IP address 162.159.143.12. No nameserver information is available from the current query. The host is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service, indicating that at least one anti‑phishing feed has flagged the domain as hostile. VirusTotal records show that the domain was submitted to 91 scanning engines; at the time of analysis none of the vendors reported a detection.

While the absence of detections does not constitute a safety guarantee, it demonstrates that the domain has not yet triggered automated signatures in the examined scanners. The available data confirm that the domain is being used for phishing, but the specific lure, target brand, page title, SSL certificate details, and HTTP response codes have not been disclosed in the current intelligence set. Consequently, the full scope of the credential‑harvesting campaign remains undetermined. Defenders should continue to block the domain at network perimeters and endpoint filters, especially by employing blocklists that already contain the host.

Monitoring of DNS queries for the IP address 162.159.143.12 and for the fully qualified domain name is advised, as any sudden increase in resolution volume may indicate escalation. Because the registrar is Wix.com Ltd., organizations that permit user‑generated content on Wix platforms should consider tightening outbound traffic controls to this provider’s address space. Ongoing collection of page content, HTTP headers, and TLS certificate attributes is recommended to enrich future attribution and to support the development of detection signatures. Until further evidence emerges, the domain should be treated as a confirmed phishing source and remain on deny lists.