startupheldcdn[.]wixstudio[.]com

Analysis of startupheldcdn.wixstudio.com shows a domain that was created on December 17, 2016 and is registered through the Wix Studio platform. The domain is currently using the NS1 name server cluster (dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, dns4.p08.nsone.net). It appears on a single security blocklist, specifically PhishDestroy, indicating that at least one reputable anti‑phishing feed has identified the domain as malicious.

VirusTotal scans have recorded detections from 12 of 91 security vendors, providing additional corroboration that the domain is being leveraged for abusive activity. No public evidence is available regarding the underlying hosting IP address, SSL certificate status, HTTP response codes, or any associated page title, so the exact content served by the site remains unverified. The lack of broader blocklist presence does not imply safety; rather, the existing detections suggest a focused phishing campaign that may be targeting users of services hosted on Wix platforms.

Defenders should continue to block the domain at perimeter firewalls, update DNS filtering rules to include the domain, and monitor outbound connections for any attempts to resolve or contact the host. Incident response teams should treat any credential submission to this domain as potentially compromised and advise affected users to reset passwords and review account activity. Ongoing intelligence collection is recommended to determine whether additional indicators, such as IP reputation or payload samples, emerge in future scans.