us-en-exidus[.]wixstudio[.]com

On 24 July 2026 the domain us-en-exidus.wixstudio.com was observed in active phishing investigations. The domain resolves to the IPv4 address 162.159.143.12 and is hosted by Wix.com Ltd., as indicated by the registrar information. The same IP is associated with Wix’s infrastructure, which frequently uses shared hosting environments. The domain appears on a single security blocklist and is currently blocked by the PhishDestroy filtering service. VirusTotal records show that the domain was submitted to 91 scanning engines; none of the engines returned a positive classification at the time of analysis.

The lack of detections does not constitute evidence of benign behavior, especially given the limited visibility into the hosted content. Nameserver data could not be retrieved (NS_NOT_FOUND), preventing confirmation of DNS delegation or potential use of custom name servers. No SSL/TLS certificate details, HTTP status codes, page title, or content snapshots are available, leaving the exact phishing payload or targeted brand unspecified. The available evidence suggests that the domain is being leveraged as part of a generic phishing campaign, likely exploiting Wix’s rapid site‑creation capabilities to host malicious pages. The presence on a blocklist and the active status reported by PhishDestroy indicate that at least one security vendor has observed malicious activity originating from this host.

However, the absence of additional detections and the lack of publicly disclosed content limit the ability to attribute a specific attack vector or victim profile. Defenders should consider immediate network‑level mitigation by adding 162.159.143.12 to deny‑lists or by enforcing DNS filtering for the fully qualified domain name. Continuous monitoring of the domain’s DNS records and any future VirusTotal submissions is recommended.