io-metereocdn[.]wixstudio[.]com

Analysis of io-metereocdn.wixstudio.com indicates that the domain has been actively leveraged for generic phishing operations. The domain was originally registered on December 17, 2016 through the Wix Studio platform, which provides hosted website builder services. Its authoritative name servers are dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net, indicating that the hosting infrastructure is supplied by the NSONE network. The domain appears on a single public security blocklist and has been explicitly added to the PhishDestroy blocklist, confirming that at least one anti‑phishing service has observed malicious activity associated with the host.

VirusTotal scans show that 11 of 91 security vendors have flagged the domain, providing independent corroboration of its abusive nature. The detection count suggests that multiple sandbox and URL‑reputation engines have identified phishing‑related behavior, although the exact payload or credential‑harvesting technique is not disclosed in the available data. No additional public intelligence such as Safe Browsing alerts, OTX references, or SSL certificate anomalies are currently reported. Given the registration age, the use of a commercial website‑builder service, and the presence of multiple vendor detections, defenders should treat the domain as high‑risk.

Recommended mitigation steps include adding the domain to network‑level deny lists, configuring web‑proxy filters to block HTTP/HTTPS requests to the host, and monitoring DNS queries for the four NSONE name servers for signs of internal resolution. Incident response teams should also consider gathering host‑based indicators such as IP addresses resolved by the name servers, as these may be useful for downstream correlation with compromised user accounts. Continuous re‑evaluation is advised, as further threat intelligence—particularly page‑title analysis or observed phishing campaigns—may emerge and refine the risk profile.