more-trezocdn[.]wixstudio[.]com

The domain more-trezocdn.wixstudio.com was registered on June 03, 2026 through GoDaddy.com, LLC and resolves to the Google Cloud IP address 34.144.206.118, which is geolocated in the United States. DNS resolution is serviced by four NS1 nameservers (dns1.p08.nsone.net through dns4.p08.nsone.net). The site presented a HTTP 404 response with the page title "404 Error: Page Not Found | Wix Studio" and employed a TLS certificate issued by Let’s Encrypt (R13). Infrastructure fingerprinting shows the presence of Wix‑hosted assets, a React front‑end, Google Cloud CDN, and HTTP/3 support, indicating that the attacker leveraged legitimate Wix Studio hosting components to give the domain an authentic appearance.

The domain is currently taken offline, but it was previously flagged by PhishDestroy and listed on one security blocklist. VirusTotal analysis recorded 12 detections out of 91 scanning engines, confirming malicious intent. The combination of a recent registration date, use of a reputable brand’s sub‑domain, and the presence of a valid SSL certificate suggests an attempt to spoof Wix Studio services, likely to harvest credentials or deliver further payloads.

Uncertainties remain regarding the exact phishing payload and target audience, as the site content was not captured beyond the 404 title. Defenders should add the domain to internal blocklists, monitor DNS queries for the associated IP range, and enforce TLS inspection to detect any future payloads. Network sensors should flag traffic to the identified IP and nameservers, and incident response teams should verify whether any credential submissions were attempted from this host before it was taken offline.