globaltrezrcdn[.]wixstudio[.]com

Analysis of globaltrezrcdn.wixstudio.com, conducted on July 22, 2026, indicates active phishing infrastructure hosted under the WixStudio subdomain platform. The domain is currently flagged by one security blocklist, specifically PhishDestroy, and remains unresolved in public DNS as indicated by the NS_NOT_FOUND nameserver status. Despite this, the domain resolves to IP address 162.159.143.12, which is part of Cloudflare’s network (AS13335), a common hosting provider for both legitimate and malicious content. No additional detection vendors, Safe Browsing results, or threat intelligence feeds (e.g., OTX) are currently reflected in available data, limiting visibility into broader detection coverage or historical abuse patterns.

The domain is registered through Wix.com Ltd., a platform that allows users to create and host websites under subdomains of wixsite.com and wixstudio.com. This infrastructure is frequently exploited for phishing due to its accessibility and built-in SSL certificates, though no specific phishing kit or brand impersonation has been confirmed in this case. The absence of nameserver resolution suggests possible misconfiguration or intentional obfuscation, though it may also reflect a transient state during domain setup or takedown attempts. No HTTP status, SSL certificate details, or page title data is available to further assess the site’s content or intent.

Defenders should treat this domain as active phishing infrastructure based on its blocklist status and hosting context. Network-level blocking of 162.159.143.12 may mitigate exposure, though Cloudflare’s shared IP usage requires caution to avoid overblocking. Further investigation is warranted to determine the exact phishing lure, target brand, or scam type, as current evidence does not specify these details. Monitoring for changes in DNS resolution, additional blocklist inclusions, or shifts in hosting IP will help track the domain’s lifecycle and potential evolution.