share-trexo[.]wixstudio[.]com

This domain is flagged for hosting a generic phishing scheme designed to harvest credentials through a fake login portal. Analysis indicates an elevated risk level due to its infrastructure and detection history, though the page currently returns a 404 error, suggesting recent takedown or evasion efforts. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on May 30, 2026, an anomalous future date that may indicate registry manipulation or typosquatting. It resolves to IP address 34.144.206.118, hosted on Google Cloud with HTTP/3 and Google Cloud CDN technologies detected. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. The domain appears on one security blocklist and is flagged by 12 out of 95 security vendors in aggregated threat intelligence platforms. Detected technologies include Wix and React, which are frequently abused for phishing due to their ease of deployment and legitimate appearance. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP at the network perimeter. Organizations should monitor for credential reuse from affected users, as fake login portals often target corporate or financial accounts. Security teams are advised to review logs for connections to 34.144.206.118 and cross-reference with known phishing indicators. User awareness training should emphasize the risks of entering credentials on unfamiliar login pages, even those hosted on seemingly legitimate platforms like Wix. Given the anomalous creation date, additional scrutiny of domains registered through the same registrar around this period is recommended.