dyydx-exchang-us[.]wixstudio[.]com

Analysis of dyydx-exchang-us.wixstudio.com shows the domain is actively used for phishing. The domain resolves to the IPv4 address 34.144.206.118, indicating hosting on a cloud provider that is shared among multiple unrelated sites. Registration data reveals the domain was created on 17 December 2016 and was registered through the Wix Studio platform, a website‑builder service that offers free sub‑domains. The authoritative name servers are dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net and dns4.p08.nsone.net, all of which are operated by NSONE and are commonly used by legitimate services, which can make static DNS reputation less reliable.

The domain is listed on one external security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing feed has identified it as malicious. VirusTotal scans show that five of ninety‑one security vendors have flagged the domain, providing independent confirmation of malicious intent. No additional public intelligence such as SSL certificate details, HTTP response codes, page title, or brand targeting is currently available, limiting the ability to describe the exact phishing lure or payload. Defenders should therefore treat any traffic to this domain as hostile.

Recommended mitigations include adding the domain to network‑level deny lists, updating DNS filtering policies to block the four NSONE name servers associated with this domain, and configuring endpoint protection to enforce the VirusTotal detection. Continuous monitoring of the IP address 34.144.206.118 for new associations, as well as periodic re‑scanning of the domain on VirusTotal, will help detect any changes in the threat posture. Because the domain is hosted on a shared infrastructure, other unrelated tenants may be impacted if blanket blocking is applied; however, given the elevated risk rating and confirmed phishing activity, the precautionary block is justified.