trexer-startedio[.]wixstudio[.]com

The domain trexer-startedio.wixstudio.com is currently active and identified as a crypto drainer phishing site. Analysis indicates this infrastructure is designed to target cryptocurrency wallet users, tricking them into authorizing malicious transactions that drain funds. No specific brand impersonation has been confirmed, but the site employs social engineering tactics typical of crypto-focused phishing campaigns. Infrastructure analysis reveals the domain is hosted on Wix Studio’s platform, resolving to the IP address 34.144.206.118. It uses a Let’s Encrypt SSL certificate, a common tactic to appear legitimate. VirusTotal detection shows 2 of 95 security vendors flag this domain as malicious. The domain appears on two security blocklists and is actively blocked by MetaMask and SEAL, indicating confirmed malicious activity. No historical registration data is publicly available due to the use of a hosted website builder service, limiting further attribution. Current status remains active, posing a high risk to users. Recommendations include immediate blocking of the domain and IP at the network level, particularly for organizations handling cryptocurrency transactions. End users should avoid interacting with the site and verify wallet approvals using official wallet interfaces. Security teams are advised to monitor for related infrastructure, such as subdomains or newly registered domains with similar naming patterns, and update detection rules to include this domain and its associated indicators.