accapps-trexorcdn[.]wixstudio[.]com

This domain, accapps-trexorcdn.wixstudio.com, is currently flagged for credential theft activity targeting unsuspecting users. Analysis indicates no direct brand impersonation or crypto drainer kit deployment at this stage, but the infrastructure aligns with known phishing patterns designed to harvest login credentials, payment details, or other sensitive data. The domain leverages a hosting provider’s subdomain structure, which is frequently abused to bypass initial security scrutiny due to its association with legitimate services. Technical indicators reveal the following: the domain resolves to IP address 34.144.206.118, hosted on a platform utilizing Google Cloud and Google Cloud CDN. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. VirusTotal reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged. The site employs modern web technologies, including React and HTTP/3, which may complicate automated detection efforts. No creation date or registrar details are publicly available for this subdomain, as it is nested under a larger hosting provider’s infrastructure. Google Safe Browsing (GSB) status is currently unlisted, and no blocklist entries have been recorded at this time. The domain remains active and under investigation, with no takedown or mitigation actions observed as of this analysis. While the lack of detections on VirusTotal and blocklists may suggest low immediate risk, the domain’s structure and hosting environment present a credible threat for credential theft. Users are advised to exercise caution when encountering this domain, particularly if prompted for login credentials or personal information. Organizations should monitor network traffic for connections to 34.144.206.118 and consider proactive blocking of the domain to prevent potential exposure. Further analysis is required to determine the full scope of the threat and any associated campaigns.