my-tanggemcdn[.]wixstudio[.]com

Analysis conducted on July 29, 2026 identifies my-tanggemcdn.wixstudio.com as an active phishing endpoint leveraging Wix Studio's subdomain infrastructure. The domain was registered on December 17, 2016 through Wix Studio, a legitimate website builder platform, which is frequently exploited for phishing due to its free subdomain offerings and built-in SSL certificates. Infrastructure analysis reveals the domain utilizes nameservers dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net, indicating DNS management via NS1, a provider commonly used by both legitimate and malicious actors for its reliability and scalability. Detection data from July 2026 shows the domain is flagged by 5 of 91 security vendors on VirusTotal, a modest but notable detection rate that suggests emerging recognition of its malicious intent. Additionally, the domain appears on one security blocklist and is specifically blocked by PhishDestroy, a specialized anti-phishing service.

The combination of these detections and the domain's persistence since 2016 raises concerns about its use in long-term phishing operations, potentially targeting users through deceptive content hosted under the guise of a content delivery network (CDN) service. The exact nature of the phishing content remains unconfirmed, as no specific brand impersonation, scam category, or page title is provided in available intelligence. However, the subdomain structure (my-tanggemcdn) suggests an attempt to mimic a CDN or cloud service, which is a common tactic to lend credibility to malicious pages. Defenders should note that the domain's registration predates the detection activity by nearly a decade, which may indicate either a dormant period followed by reactivation or continuous low-level abuse that evaded earlier scrutiny.

Organizations are advised to block this domain at the DNS or proxy level and monitor for related subdomains under the wixstudio.com parent domain.