iostarted-trexio[.]wixstudio[.]com

PhishDestroy identifies the domain iostarted-trexio.wixstudio.com as a generic phishing page currently under investigation for potential brand impersonation or credential theft activities. The site masquerades under the Wix Studio platform and employs deceptive naming to appear legitimate, likely targeting cryptocurrency users or Trex-related services. No specific drainer kit signatures or payloads have been confirmed at this stage, but the domain’s structure and hosting environment suggest malicious intent aligned with crypto drainer operations.

Technical indicators confirm the following: VirusTotal detection rate stands at 8/95 engines as of the latest scan, indicating a low detection profile despite active abuse. The domain resolves to IP address 34.144.206.118, which is associated with Google Cloud services. The SSL certificate is issued by Let’s Encrypt, providing a false sense of security. The domain was registered under Wix Inc. via a Wix-managed subdomain setup, complicating traditional takedown routes. As of this analysis, the domain remains unblocked by Google Safe Browsing (GSB) and has not been flagged by major threat intelligence blocklists, presenting a significant window of exposure.

This domain is currently marked as active with a risk level categorized as 'under_investigation.' PhishDestroy has flagged this threat and assigned a unique seed identifier (7eb9a7) for tracking and verification. Immediate action includes blocking the domain at the network level and alerting hosting providers and platform partners. Users are advised to avoid interacting with this domain and to report any related phishing attempts. While the immediate risk is classified as moderate due to low detection and lack of widespread blocklisting, the absence of proactive blocking increases exposure for potential victims. Continuous monitoring is in effect, and updates will be provided as the investigation progresses.