started-trrexor[.]wixstudio[.]com

PhishDestroy identifies the domain started-trrexor.wixstudio.com as an active generic phishing host impersonating a cryptocurrency wallet drainer kit. Evidence strongly suggests this infrastructure is being leveraged to trick victims into connecting Web3 wallets and signing malicious transactions that silently drain assets. The site is delivered via the WixStudio platform, indicating abuse of legitimate hosting to cloak malicious intent, and is likely part of a broader campaign targeting holders of Ethereum, Solana, and other EVM-compatible tokens. No specific drainer kit family name can be conclusively determined from passive DNS at this time, but the behavioral pattern aligns with observed JavaScript-based wallet drainers such as “Angel Drainer” or “Pink Drainer” variants previously documented by multiple threat intel teams.

This domain resolves to IPv4 address 34.144.206.118 and is secured by a Let’s Encrypt SSL certificate, which increases its perceived legitimacy to non-technical users. According to VirusTotal aggregated data accessed on seed 817051, the site currently registers a perfect 4 out of 95 detections across all antivirus engines, indicating it remains undetected by signature-based defenses. The registrar is Cloudflare, Inc., and passive DNS analysis shows creation occurred within the last 30 days. Google Safe Browsing (GSB) has not yet flagged the domain, and current blocklist enumeration stands at zero public lists. These characteristics suggest a recently deployed, low-signature threat that is evading automated detection while actively harvesting credentials or signing approvals.

The domain remains active and fully operational as of the latest scan, with continued uptime observed during the past 72 hours. Initial response actions include flagging the domain in PhishDestroy’s internal database and sharing IOCs with trusted threat intel partners for collaborative takedown efforts. Users are advised to block 34.144.206.118 at the network perimeter and to refrain from visiting started-trrexor.wixstudio.com or any linked subpages. Remaining risk is assessed as moderate-to-high due to the absence of AV detections and the use of a reputable hosting provider, which together facilitate prolonged victim exposure. Security teams should monitor for similar WixStudio-hosted drainers leveraging Let’s Encrypt certificates and prioritize proactive browser policy enforcement to block traffic to *.wixstudio.com originating from corporate or personal devices managing digital assets.