metreora[.]wixstudio[.]com

metreora.wixstudio.com was registered on June 8, 2026 via the Wix Studio platform. Within weeks of its creation the domain appeared on a public phishing blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that 5 of 91 scanning engines have flagged the domain as malicious, indicating that at least a subset of security products recognize it as a threat. The domain’s hosting provider is Wix, a widely used website builder, which can make abuse attribution more challenging because many legitimate sites share the same infrastructure.

No additional public intelligence such as Safe Browsing alerts, OTX mentions, or SSL certificate anomalies have been published for this host. The limited detection footprint suggests that the phishing campaign may be in an early deployment stage or that the payload is hosted elsewhere, leaving the domain primarily as a lure or redirect point. Defenders should add metreora.wixstudio.com to inbound and outbound filtering rules, monitor DNS queries for this name, and ensure that any user‑initiated connections to the domain are blocked at the firewall or proxy level.

Because the domain is newly created, its IP address could change; continuous re‑resolution is recommended. Security teams should also consider reviewing traffic to other Wix‑hosted subdomains that share similar creation dates, as attackers often leverage the same registrar for multiple campaigns. Until further forensic evidence becomes available, the presence on a blocklist and the VirusTotal flags warrant an elevated risk rating and proactive mitigation.