eng-bitbuycdn[.]wixstudio[.]com

On July 29, 2026 the domain eng-bitbuycdn.wixstudio.com was assessed as an active generic phishing infrastructure with an elevated risk rating. The domain was originally registered on December 17, 2016 through the Wix Studio platform, indicating that the attacker leveraged a legitimate website‑building service to obtain a seemingly benign sub‑domain. All four authoritative name servers resolve to nsone.net (dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, dns4.p08.nsone.net), a common configuration for Wix‑hosted sites. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, demonstrating that at least one external sinkhole has identified malicious use.

VirusTotal analysis shows that 2 of 91 scanned security vendors flagged the domain, providing additional independent confirmation of suspicious activity. The available evidence does not include HTTP response codes, SSL certificate details, hosting IP address, or page‑title information, leaving the exact payload and target brand undefined. Consequently, defenders cannot confirm which credential‑capture pages are served or which user‑facing assets are impersonated. The lack of visible content also prevents verification of any specific phishing kit or campaign tactics.

Given the confirmed presence on a blocklist, the dual vendor detections on VirusTotal, and the active status, security teams should treat eng-bitbuycdn.wixstudio.com as malicious. Recommended mitigations include adding the domain to URL filtering policies, updating endpoint and web‑gateway blocklists, and monitoring DNS queries for the associated nsone.net name servers. Organizations should also educate users about unsolicited links that resolve to Wix‑hosted sub‑domains, as attackers may exploit the platform’s reputation to increase click‑through rates.