cdndax[.]wixstudio[.]com

cdndax.wixstudio.com was observed on July 29 2026 as an active generic‑phishing infrastructure. The domain was registered through Wix Studio on 17 December 2016 and continues to use the provider’s default name‑server set: dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net. VirusTotal reports that 12 out of 91 scanning engines have flagged the host, indicating a modest but non‑trivial detection rate.

The domain is listed on a single external blocklist and is explicitly blocked by the PhishDestroy mitigation service. No additional public intelligence such as IP address, SSL certificate details, HTTP response codes, or page‑title metadata has been disclosed in the current dataset, so the underlying hosting location and surface‑level webpage characteristics remain unverified. The available evidence suggests that the domain is leveraged for credential‑harvesting campaigns, consistent with its classification as a generic phishing site.

Defenders should add cdndax.wixstudio.com to outbound‑traffic denial lists, ensure that any proxy or DNS filtering solutions reference the blocklist entries that already contain the domain, and monitor for related sub‑domains that may share the same NSONE name‑server cluster. Continuous re‑scanning on VirusTotal or comparable multi‑engine platforms is recommended to track changes in detection ratios, and any future acquisition of TLS certificates or HTTP redirects should be incorporated into broader threat‑intel feeds.