bridge-treoio[.]wixstudio[.]com

Analysis of the domain bridge-treoio.wixstudio.com, conducted on July 24, 2026, indicates it was actively used for a crypto scam phishing operation before being taken offline. The domain, registered through GoDaddy.com, LLC on March 22, 2026, resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure in the United States. The site employed Wix as its content management platform, alongside technologies such as React, Google Cloud, and Google Cloud CDN, with HTTP/3 support. SSL certification was provided by Let’s Encrypt, a common choice for both legitimate and malicious sites.

At the time of investigation, the domain returned an HTTP 404 status with the page title '404 Error: Page Not Found | Wix Studio,' suggesting the phishing content had been removed or the site was intentionally disabled. Despite its offline status, the domain appears on one security blocklist, and three of 94 security vendors on VirusTotal flagged it as malicious. The scam type was explicitly classified as a crypto scam, though the exact mechanics—such as whether it involved fake wallets, fraudulent exchanges, or investment schemes—remain unconfirmed due to the lack of accessible page content. Infrastructure analysis reveals the domain used nameservers dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net, which are associated with legitimate DNS providers but are also frequently leveraged by threat actors to blend in with benign traffic.

The use of Wix Studio, a legitimate website builder, further complicates detection, as phishing pages hosted on such platforms often evade initial scrutiny. Defenders should note that while the domain is currently offline, its prior association with a crypto scam and its presence on security blocklists warrant continued monitoring. Organizations are advised to block access to this domain at the network level and review logs for any prior connections from internal systems.