enus-terzorstart[.]wixstudio[.]com

Analysis indicates that the domain enus-terzorstart.wixstudio.com was registered on 8 June 2026 via the Wix Studio platform. The short lifespan suggests a rapid‑deployment infrastructure commonly used in credential‑harvesting operations. VirusTotal scans show that nine out of ninety‑one security vendors flagged the domain, confirming that multiple detection engines have identified malicious characteristics. The domain is currently listed on a single security blocklist and is actively blocked by the PhishDestroy service, demonstrating that at least one mitigation service has incorporated it into its protection feeds.

The registration through Wix Studio implies that the site is hosted on a shared‑hosting environment provided by the Wix ecosystem, which can make attribution of underlying IP infrastructure more challenging. No explicit IP address or autonomous system information is available in the supplied intelligence, and the HTTP response details, SSL certificate data, and page title have not been disclosed. Consequently, the precise hosting location and any potential content served by the site remain unknown. Given the elevated risk rating and the active status, defenders should continue to monitor network traffic for connections to this domain and enforce blocklisting at perimeter defenses.

Integration of the domain into existing URL filtering, DNS sink‑hole, or proxy blocklists will prevent end‑user access. Organizations employing threat‑intelligence platforms should ingest the detection count and blocklist identifiers to enrich their detection rules. Regular re‑scanning of the domain with sandbox and URL reputation services is recommended to capture any changes in payload or hosting that may arise as the campaign evolves.