io-started-treizr[.]wixstudio[.]com

This domain, io-started-treizr.wixstudio.com, was registered through GoDaddy.com, LLC on 22 March 2026 and resolves to the Google Cloud address 34.144.206.118 located in the United States. The site presents a TLS certificate issued by Let’s Encrypt, indicating encrypted transport, but the certificate does not convey any reputational trust. An HTTP request returns a 404 status with the page title “404 Error: Page Not Found | Wix Studio”, confirming that the underlying Wix‑based site is either misconfigured or deliberately removed. Technical fingerprints show the presence of Wix, React, Google Cloud, Google Cloud CDN and HTTP/3, all standard components of the Wix Studio platform. VirusTotal has recorded 12 of 94 security‑vendor detections for this domain, reflecting a consensus among multiple scanners that the host is associated with malicious activity.

The domain appears on one public blocklist and is explicitly listed by PhishDestroy as a known phishing infrastructure, reinforcing the classification. Nameserver records point to the nsone.net cluster (dns1.p08.nsone.net through dns4.p08.nsone.net), a common configuration for domains hosted on third‑party services. The current offline status indicates that the site is no longer serving content, yet the remnants of the infrastructure remain active and could be repurposed. Because the content has not been captured, the exact phishing payload or targeted brand cannot be confirmed, and the 404 response prevents direct analysis of any credential‑capture pages.

Nonetheless, the combined evidence—registrar age, hosting on a shared Wix environment, multiple vendor detections, blocklist inclusion, and PhishDestroy tagging—strongly suggests that the domain was employed for a generic phishing campaign. Defenders should continue to block the domain at perimeter filters, update DNS sinkhole lists with the associated IP address and nameservers, and monitor for any re‑activation of the host.