io-changenowcdn[.]wixstudio[.]com

The domain io-changenowcdn.wixstudio.com was created on December 17, 2016 and is registered through the Wix Studio platform. Its authoritative name servers are dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net, indicating hosting on the NSONE DNS infrastructure. The domain is listed on a single public security blocklist and has been explicitly blocked by the PhishDestroy filtering service, which classifies it as a phishing resource.

VirusTotal reports that five of ninety‑one scanning engines have flagged the domain as malicious, providing additional corroboration of its hostile intent. No publicly available data on SSL/TLS configuration, HTTP response codes, or underlying IP address is present in the current intelligence set, leaving the exact server location and certificate status unconfirmed. The lack of a page title, brand identifier, or detailed payload description prevents a precise attribution of the phishing campaign’s target, but the combination of blocklist presence, vendor detections, and the Wix‑based hosting model aligns with known patterns of credential‑stealing infrastructure that leverages free‑hosting services to obscure ownership.

Defenders should add io‑chang​enowcdn.wixstudio.com to network deny lists, enforce DNS‑level blocking, and monitor for any outbound connections to the NSONE name servers associated with this domain. Continuous re‑scanning on VirusTotal and periodic checks against PhishDestroy and other phishing‑specific feeds are recommended to capture any changes in detection status or additional malicious indicators that may emerge.