bingxx[.]wixstudio[.]com

Analysis conducted on July 29, 2026 identifies bingxx.wixstudio.com as an active credential-theft phishing domain. The subdomain is hosted on Wix Studio infrastructure, registered on December 17, 2016, and currently resolves to nameservers dns1.p08.nsone.net through dns4.p08.nsone.net. Security vendor PhishDestroy has blocked the domain, and it appears on one additional blocklist. VirusTotal scans reveal that 3 of 91 security vendors flag the domain as malicious, indicating elevated risk.

Infrastructure analysis reveals the domain leverages Wix Studio's platform-as-a-service model, which allows rapid deployment of phishing pages without requiring dedicated hosting. The registration date predates the observed malicious activity, suggesting the legitimate subdomain may have been compromised or repurposed for phishing. No specific brand impersonation or scam category is confirmed in available data, though the generic phishing classification aligns with credential harvesting patterns commonly observed on compromised subdomains. Defenders should treat this domain as an active threat.

Network-level blocking is recommended for organizations, particularly those using Wix Studio or similar website builders that may be targeted for subdomain abuse. Security teams should monitor for connections to bingxx.wixstudio.com in proxy logs and endpoint telemetry, as these may indicate successful phishing attempts or ongoing reconnaissance. Given the domain's presence on multiple blocklists and detection by commercial security vendors, automated remediation workflows should prioritize this indicator for immediate containment.