apps-htxoauth[.]wixstudio[.]com

The domain apps-htxoauth.wixstudio.com is currently listed as an active phishing infrastructure with an elevated risk rating. It was first registered on 17 December 2016 through the Wix Studio registrar, indicating a long‑standing presence that may have been repurposed for malicious use. The domain resolves to the IPv4 address 34.144.206.118 and is served from name servers dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nso, a configuration that matches other Wix‑hosted sites and does not, by itself, imply malicious intent.

However, the domain is blocked by the PhishDestroy service and appears on a single security blocklist, confirming that at least one reputable anti‑phishing engine has observed abusive activity associated with it. VirusTotal analysis shows that 12 out of 91 scanners flagged the domain, providing additional independent corroboration of its malicious reputation. No publicly available page title, SSL certificate details, HTTP status code, or Safe Browsing verdict are present in the supplied intelligence, leaving the exact payload or credential‑stealing technique undefined.

The lack of observable content means that analysts cannot confirm whether the site presents a credential‑capture form, redirects to another host, or employs additional evasion mechanisms. Defenders should therefore treat the domain as hostile: network perimeter controls should block DNS resolution and HTTP/HTTPS traffic to the domain and its resolved IP address; intrusion‑detection signatures that reference the observed nameserver set or the IP range may be useful; and continuous monitoring for any changes in the name‑server configuration or additional detection reports is advised. Until further forensic evidence is gathered, the precautionary stance of blocking all communications with apps-htxoauth.wixstudio.com is warranted.