paypaloauth[.]wixstudio[.]com

Analysis conducted on July 20, 2026 identifies paypaloauth.wixstudio.com as an active infrastructure used for banking credential harvesting. The domain resolves to the IPv4 address 34.144.206.118 and remains reachable at the time of writing. Registration data shows the domain was created through Wix.com Ltd., a popular website‑builder platform, indicating the use of a legitimate registrar to obscure malicious intent. VirusTotal records indicate the domain has been submitted to 95 scanning engines, yet none have generated a detection; this lack of flags does not constitute evidence of safety and should be treated as inconclusive. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy mitigation service, suggesting that at least one external sinkhole or filtering organization has identified it as malicious. Nameserver information is unavailable (NS_NOT_FOUND), limiting further resolution analysis. No public Safe Browsing, Open Threat Exchange, SSL certificate, HTTP status, trust score, page‑title, or evidence‑link data were observed, leaving those vectors unverified. Defenders should consider the domain as a high‑confidence phishing indicator, block network traffic to 34.144.206.118, and enforce email filtering rules that detect URLs containing the "paypaloauth" sub‑domain pattern. Continuous monitoring of the host’s activity, periodic re‑scans on VirusTotal, and correlation with user‑reported phishing attempts are recommended to confirm ongoing threat activity and to update mitigation policies as additional intelligence becomes available.