myusupheldcdnsso[.]wixstudio[.]com

myusupheldcdnsso.wixstudio.com is currently listed as an active generic phishing infrastructure with an elevated risk rating. The domain was first registered on 17 December 2016 through the Wix Studio registrar and is hosted on NS1’s four‑node name server set (dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, dns4.p08.nsone.net). Its presence on a public phishing blocklist and the fact that it is specifically blocked by the PhishDestroy service indicate that it has been observed delivering malicious credential‑harvesting pages. VirusTotal scans have returned five positive detections out of ninety‑one submitted security vendors, reinforcing the suspicion that the site hosts or redirects to phishing content.

At the time of analysis the domain appears on one external blocklist; no additional public reputation services have been cited. No information on SSL configuration, HTTP response codes, or page title has been published, leaving those aspects unverified. The limited detection footprint suggests that the payload may be low‑profile or that the site is intermittently active, which aligns with its classification as an active threat. Because the registrar is a consumer‑grade website builder, attribution to a specific actor is not possible; the infrastructure could be rented by a threat actor to exploit the ease of domain creation.

The lack of publicly available SSL/TLS data prevents verification of certificate misuse, and the absence of a captured page title means that content analysis cannot be performed at this stage. Consequently, security teams should treat any traffic to the domain as malicious, enforce strict outbound filtering, and employ sandbox analysis on any downloaded artifacts that may originate from the domain. Correlation with other domains using the same NSOne name servers may uncover additional phishing campaigns.