extenson-trust-us[.]wixstudio[.]com

PhishDestroy identifies extenson-trust-us.wixstudio.com as a domain currently involved in a browser extension trust phishing campaign, classified under active investigation with a risk level marked as under_investigation. The specific threat is a fake extension trust scam designed to trick users into granting malicious permissions or downloading rogue browser extensions under the guise of legitimate trust verification. This domain leverages a Wix Studio subdomain to host content that mimics official extension trust pages, commonly seen in supply-chain attacks targeting users of popular browsers like Chrome or Edge. The operation remains active as of the latest scans, with no detections from VirusTotal’s 95-engine scan (5/95) and an SSL certificate issued by Let’s Encrypt to enhance credibility. Its infrastructure maps to IP 34.144.206.118, a Google Cloud address, which is frequently used by threat actors to host short-lived phishing pages. This domain was flagged based on multiple technical indicators and contextual threat intelligence. VirusTotal currently shows 0 detections out of 95 antivirus engines, indicating that signature-based detection has not yet caught up to this threat, which is typical for newly deployed phishing campaigns. The domain resolves to IP 34.144.206.118, a Google Cloud IP address, commonly used by threat actors due to its reliability and anonymity. The SSL certificate from Let’s Encrypt adds a veneer of legitimacy, increasing the likelihood of user deception. While explicit creation dates and registrar details are not provided in the dataset, the active status and fresh SSL certificate suggest recent registration and deployment. No current blocklist entries were detected, highlighting the need for proactive user vigilance and behavior-based detection mechanisms. To mitigate the risk posed by this fake extension trust scam, users should avoid interacting with any links or pages hosted on extenson-trust-us.wixstudio.com or similar subdomains of wixstudio.com. If you encounter such a page, do not enter any personal information, grant permissions, or download any extensions. Instead, report the domain to your browser vendor and cybersecurity platforms. Always verify extension authenticity through official channels like the Chrome Web Store or Edge Add-ons, and use multi-layered security tools such as browser-based phishing protection, ad-blockers with phishing filters, and DNS-level protections like NextDNS or Cloudflare Family. Staying updated on emerging threats and enabling real-time scanning can help prevent falling victim to such scams.