ndx-us[.]wixstudio[.]com

Analysis of ndx-us.wixstudio.com shows that the domain is actively used in a generic phishing campaign. The site is listed on a single security blocklist and has been specifically blocked by the PhishDestroy feed. VirusTotal reports that five of ninety‑one scanning engines have flagged the domain, indicating that at least a subset of anti‑malware products have observed malicious behavior associated with it.

The domain was created on 17 December 2016 and the registration was processed through Wix Studio, a legitimate website‑building service, which suggests the attacker leveraged a free‑hosting platform to obtain a seemingly benign URL. The authoritative name servers are dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net, pointing to the NSONE hosting infrastructure. No additional intelligence such as IP reputation, SSL certificate details, HTTP response codes, Safe Browsing status, or page‑title metadata is currently available, leaving the exact hosting location and content of the landing page unverified.

Defenders should treat the domain as high‑risk: enforce network‑level denial of any outbound connections to the listed name servers, add the domain to internal blocklists, and monitor DNS query logs for attempts to resolve it. Where possible, ingest the five VirusTotal detections into security information and event management (SIEM) rules to trigger alerts on related traffic. Continuous re‑assessment is advised, as further evidence may emerge from additional scanning services or community feeds.