ssostarts-trexocdn[.]wixstudio[.]com

On 29 July 2026 analysts examined ssostarts-trexocdn.wixstudio.com after it was reported as an elevated‑risk generic phishing site. The domain was created on 17 December 2016 and is registered through the Wix Studio platform, indicating use of a legitimate website‑builder service for malicious purposes. Its authoritative nameservers are dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net and dns4.p08.nsone.net, which are typical of NSONE hosting and do not reveal direct ties to a dedicated threat‑hosting provider.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing feed considers it malicious. VirusTotal scans show that 13 of 91 security vendors flagged the domain, providing independent corroboration of its suspicious nature. No additional public evidence such as Safe Browsing alerts, Open Threat Exchange (OTX) entries, SSL certificate details, HTTP response codes, trust‑score metrics, or page‑title information is currently available.

Consequently, the precise payload, targeted brand, or phishing landing‑page characteristics remain unknown. Defenders should immediately deny network resolution of ssostarts-trexocdn.wixstudio.com, add it to local and cloud‑based blocklists, and monitor DNS queries for related NSONE nameservers. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection ratios or new intelligence that may emerge.