trexiosuiteapps[.]wixstudio[.]com

This domain is actively engaged in credential harvesting operations targeting corporate users through a fraudulent business portal interface. Analysis indicates the site mimics internal enterprise resource planning or software suite login pages, designed to capture usernames, passwords, and potentially multi-factor authentication codes. The threat actor has constructed a plausible imitation of a legitimate business application portal, increasing the likelihood of successful deception against employees or contractors with access to sensitive systems. Infrastructure analysis reveals the domain trexiosuiteapps.wixstudio.com is hosted on 34.144.206.118, a cloud-based address within a major provider's network. The site employs a Let's Encrypt SSL certificate, providing a false sense of security to visitors. Detection metrics show only 1 of 95 security vendors currently flag this domain, suggesting either recent deployment or effective evasion techniques. The domain utilizes Wix hosting infrastructure, React framework, and Google Cloud CDN, indicating a sophisticated technical setup designed to handle high volumes of stolen credentials while maintaining operational resilience. Users who have visited trexiosuiteapps.wixstudio.com should immediately reset any credentials entered on the site, particularly for corporate accounts, email systems, or financial platforms. Organizations should implement additional verification for any transactions or access requests originating from accounts that may have been compromised. Network administrators are advised to block the domain and associated IP address 34.144.206.118 at perimeter security devices. Affected users should monitor accounts for unauthorized access and report any suspicious activity to their security teams. The domain remains active as of this analysis, requiring continued vigilance from both individuals and enterprise security operations.