more-dydaxx[.]wixstudio[.]com

more-dydaxx.wixstudio.com is currently listed on one public phishing blocklist and is actively blocked by the PhishDestroy service. The domain was registered through the Wix Studio platform, indicating the use of a legitimate website‑builder service for hosting. WHOIS data shows the domain was created on 17 December 2016, giving the infrastructure a long operational history. DNS resolution is delegated to four NSOne name servers (dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, dns4.p08.nso...), suggesting the domain is hosted on NSOne’s infrastructure. VirusTotal scans have returned 11 positive detections out of 91 security vendors, confirming that multiple AV engines have observed malicious characteristics associated with the domain.

No additional public intelligence such as Safe Browsing verdicts, OTX tags, IP geolocation, SSL certificate details, HTTP response codes, or page title information is presently available. Consequently, the precise phishing campaign vector, targeted brand, and credential‑harvesting mechanisms remain unconfirmed. Given the existing evidence, defenders should treat the domain as high‑confidence malicious. Immediate mitigation steps include adding the domain to network deny lists, configuring email gateways to reject messages containing the URL, and ensuring endpoint protection solutions are updated with the latest indicators of compromise.

Continuous monitoring of DNS queries for the listed name servers is advised to detect any new sub‑domains or related activity. Organizations should also consider reviewing traffic logs for connections to the domain’s IP ranges, even though specific IP addresses have not been disclosed. Because the domain is hosted on a popular website‑builder platform, it may be periodically regenerated or moved; therefore, periodic re‑assessment of the domain’s reputation and re‑scanning with VT or similar services is recommended.