suiteapp-trexzo[.]wixstudio[.]com

suiteapp-trexzo.wixstudio.com is a Wix-hosted domain under active investigation for brand impersonation phishing. This domain mimics legitimate business suite interfaces, likely targeting unsuspecting users for credential theft. The infrastructure suggests opportunistic hosting rather than a highly targeted campaign, but the use of a trusted service (Wix) complicates detection. No evidence of a cryptocurrency drainer kit or advanced obfuscation has been observed at this stage, though social engineering tactics remain a primary concern. Threat actors may be leveraging Wix’s reputation to bypass traditional email filters, increasing the risk of successful deceptions, especially in corporate environments where trusted domains are less scrutinized.

Technical indicators reveal a concerning lack of detection sophistication. The domain resolves to IP 34.144.206.118 and is powered by a Let’s Encrypt SSL certificate, which may further legitimize its appearance. VirusTotal currently shows 5/95 detections across major antivirus engines, indicating a fresh or low-sophistication threat. Domain registration details remain concealed behind privacy protection, obscuring the actor’s identity. The domain was created recently, though the exact date is not publicly disclosed. Google Safe Browsing (GSB) has not yet flagged it, and public blocklists show zero listings, suggesting this campaign is nascent. The absence of historical data and low detection rate implies this is either a fledgling operation or a deliberate attempt to evade early-stage scanners.

PhishDestroy identifies this domain as an active brand impersonation threat with high-risk potential due to its current low-detection status. The campaign is ongoing, with no signs of takedown efforts as of this analysis. Blocking the domain at the network level is recommended immediately, alongside user awareness training to recognize Wix-hosted impersonation attempts. Organizations should also monitor for associated IP ranges and SSL certificates to preemptively block related infrastructure. While the immediate risk is elevated due to unflagged status, the lack of advanced evasion techniques suggests this may not yet be a high-value target. However, given the adaptability of phishing actors, defensive postures must prioritize proactive blocking and user education to mitigate potential credential theft or financial losses.