ssouphldappscdn[.]wixstudio[.]com

Analysis of ssouphldappscdn.wixstudio.com shows a confirmed phishing infrastructure that remains active as of the report date, July 29, 2026. The domain was registered on December 17, 2016 through the Wix Studio platform, indicating that the attacker leveraged a legitimate website‑building service to obtain a seemingly benign sub‑domain. The domain resolves to four NSOne nameservers – dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net – a configuration commonly observed in compromised or malicious Wix‑hosted sites.

Threat intelligence feeds have recorded the domain on a single security blocklist, and the anti‑phishing service PhishDestroy has actively blocked it, confirming that it is being used for malicious credential‑harvesting activities. VirusTotal scans report that ten of ninety‑one security vendors flag the domain, providing independent corroboration of its malicious nature. No additional context such as page title, brand targeting, or payload details is presently available, so the exact phishing lure (e.g., credential‑stealing login page) cannot be described.

Defenders should immediately add ssouphldappscdn.wixstudio.com to deny‑list rules across DNS, web‑proxy, and endpoint protection layers, and monitor for other Wix‑studio sub‑domains exhibiting similar name‑server patterns. Continuous re‑scanning with multi‑vendor services is advised to capture any evolution of the payload or hosting changes.