starts-trexorx[.]wixstudio[.]com

starts-trexorx.wixstudio.com is a live phishing page hosted on Wix that masquerades as a Trezor cryptocurrency wallet login portal. The domain was flagged by PhishDestroy as a generic phishing site under active campaign investigation on seed 1cf629. Threat analysis indicates the page leverages a visually identical Trezor UI to deceive users into submitting wallet recovery phrases or private keys, resulting in immediate fund theft. No specific drainer kit fingerprint has been extracted yet; however, the campaign’s tactics align with clipboard-hijacking and fake wallet-connectors commonly used in seed-phrase harvesting operations. This domain resolves to IPv4 address 34.144.206.118 and is secured with a valid Let’s Encrypt SSL certificate, increasing authenticity. VirusTotal currently shows 0 detections out of 95 engines, indicating low AV coverage. The domain is registered via Wix (a legitimate hosting provider), and creation date is still under review due to Wix’s privacy protections. Google Safe Browsing (GSB) status is currently unlisted, and cross-referencing blocklist aggregators reveals zero third-party block entries as of the latest scan. These factors suggest a recently deployed, low-signature campaign designed to evade early detection. The threat remains active and under continuous monitoring. PhishDestroy has flagged the page for takedown escalation to Wix Trust & Safety, while issuing YARA rules to network defenders via the seed 1cf629 signature. Users are advised to avoid interacting with starts-trexorx.wixstudio.com and to verify URLs via official Trezor channels. Remaining risk is assessed as moderate due to the site’s legitimate hosting infrastructure and low detection footprint, which may allow prolonged operation while fund loss potential persists. Regular updates will be published as new intelligence emerges.