starting-trexocdn[.]wixstudio[.]com

This domain, starting-trexocdn.wixstudio.com, is flagged as a credential phishing threat targeting users through deceptive landing pages. Analysis indicates no direct brand impersonation or known drainer kit association, though the infrastructure suggests a generic phishing campaign designed to harvest login credentials or sensitive information. The domain leveraged a legitimate content delivery platform, which may have been abused to evade initial detection. Infrastructure analysis reveals the following technical indicators: the domain was detected by 11 out of 95 security vendors on VirusTotal, registered through GoDaddy.com, LLC, and resolved to IP address 34.144.206.118. The creation date is recorded as June 14, 2026, though this appears anomalous and may indicate registry manipulation or incorrect data. The domain was listed on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. No Google Safe Browsing (GSB) entries were identified at the time of analysis. Technologies detected include Wix, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3 support, which may have been used to enhance delivery speed and obfuscate malicious activity. The domain is currently offline, likely taken down following detection and blocklisting. While no active threat remains, the infrastructure and registration details suggest potential for reuse or rebranding under a similar domain. Organizations are advised to monitor for newly registered domains with comparable naming patterns, particularly those leveraging content delivery networks or cloud hosting. Security teams should ensure blocklists are updated to include this domain and its associated IP, and conduct retrospective analysis to identify any prior exposure within their networks.