ndaxoo-iostart[.]wixstudio[.]com

The domain ndaxoo-iostart.wixstudio.com is listed on a single public security blocklist and is actively blocked by PhishDestroy, indicating that at least one security vendor has identified it as malicious. The domain was registered on December 17 2016 through the Wix Studio registrar, a platform commonly used for rapid site deployment. Its authoritative nameservers are dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nso, which resolve the hostname to the IPv4 address 34.144.206.118.

VirusTotal analysis shows that 11 of the 91 scanned scanners flagged the domain, providing independent confirmation of suspicious behavior. No additional public intelligence such as Google Safe Browsing, OTX, or SSL/TLS certificate details have been published for this host, and the HTTP response headers and page title have not been captured in the current dataset. Consequently, the full scope of the phishing campaign—targeted brand, payload, and victim interaction flow—remains undefined.

Defensive teams should immediately add ndaxoo-iostart.wixstudio.com to web proxy and DNS filtering deny lists, enforce outbound traffic controls to the resolved IP address, and monitor network flows for connections to the NSONE nameserver cluster used by the domain. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection status, and analysts should seek to retrieve the live page content to verify the specific lure employed. Until further forensic details emerge, the domain should be treated as a confirmed phishing infrastructure with elevated risk.