hub-metaext-io[.]wixstudio[.]com

Analysis as of July 29 2026 indicates that the domain hub-metaext-io.wixstudio.com is actively leveraged in a generic phishing operation. The domain was originally registered on December 17 2016 through the Wix Studio registrar, suggesting the use of a legitimate web‑hosting platform to obscure malicious intent. Infrastructure inspection shows the domain resolves to four NSOne name servers (dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, dns4.p08.nsone.net), a configuration commonly observed in abuse cases that rely on reputable DNS providers to improve resilience against takedown attempts.

The domain appears on a single external security blocklist and is specifically listed as blocked by the PhishDestroy service, confirming that at least one dedicated anti‑phishing feed has identified it as malicious. VirusTotal scans have recorded 12 of 91 security vendors flagging the domain, providing independent corroboration of its suspicious nature. The threat is classified with an elevated risk level and remains marked as active, indicating ongoing exploitation.

No publicly available page title, brand target, or detailed payload description has been disclosed, leaving the exact phishing lures and victim profile uncertain. Defenders should proactively block hub-metaext-io.wixstudio.com at the DNS layer, incorporate it into web‑proxy and endpoint allow‑list exclusions, and monitor for any outbound connections to the associated NSOne name servers. Continuous re‑evaluation of detection vendor feeds and blocklist updates is advised to capture any escalation in the domain's malicious activity.