io-mexcs[.]wixstudio[.]com

The domain io-mexcs.wixstudio.com was registered on June 08, 2026 through the Wix Studio platform. Within weeks of its creation, it appeared on a known security blocklist and was subsequently blocked by the PhishDestroy anti‑phishing service, indicating active malicious use. VirusTotal scans show that 12 of 91 security vendors flag the domain as malicious, a detection rate that aligns with its classification as a generic phishing site. The elevated risk rating and active status further corroborate ongoing abuse. The presence on a single blocklist suggests that the domain has already been shared with at least one threat‑intel community, and the convergence of multiple independent scanners on a malicious verdict reduces the likelihood of a false positive.

Because the registration date is only weeks prior to the first detections, the threat actor likely leveraged the rapid provisioning capabilities of Wix Studio to launch a time‑sensitive campaign. Analysis of the available intelligence reveals that the domain’s hosting infrastructure is tied to the Wix Studio hosting environment, a legitimate service frequently abused by threat actors to obtain quickly provisioned URLs. No additional intelligence such as IP reputation, ASN, SSL certificate details, HTTP status codes, or page title has been provided, leaving the broader network footprint and exact phishing content uncertain. Defenders should treat io-mexcs.wixstudio.com as a confirmed phishing indicator.

Immediate actions include adding the domain to outbound and inbound web‑filtering rules, updating intrusion‑prevention signatures, and ensuring that any internal DNS resolvers block resolution. Incident response teams should monitor for related URLs that share the same Wix Studio registration pattern and consider hunting for traffic to the associated IP range.