meteoraea[.]wixstudio[.]com

Analysis indicates that the sub‑domain meteoraea.wixstudio.com was registered on June 08, 2026 via the Wix Studio service. Within weeks of its creation it appeared on a security blocklist and has been actively blocked by the PhishDestroy filtering service. VirusTotal scans show that 11 of 91 antivirus and URL‑reputation engines have flagged the domain as malicious, suggesting a non‑trivial detection rate among industry tools. The domain is currently classified as a generic phishing campaign with an elevated risk rating and remains active as of the report date, July 29, 2026.

The limited intelligence available does not include concrete details about the hosting infrastructure, IP address ranges, SSL certificate attributes, or the exact page content displayed to victims. Consequently, the precise lure or credential‑harvesting mechanism cannot be confirmed at this time. Defenders should incorporate the domain into existing URL‑filtering and DNS‑sinkhole policies, especially those that rely on blocklist feeds and the PhishDestroy service.

Monitoring for additional detections from other security vendors is advisable, as the current 11‑vendor flag count may increase. Organizations employing web‑gateway solutions should ensure that the domain is denied at the proxy layer and that any attempted connections are logged for forensic review. Continuous re‑evaluation is recommended because the infrastructure could evolve, and further analysis of the page title or content may reveal additional indicators of compromise.