trezioosrt[.]wixstudio[.]com

PhishDestroy identifies Trezioosrt.wixstudio.com as an active phishing domain posing as a legitimate service platform. This site is currently under investigation and remains unblocked by most security vendors, indicating a stealthy and evolving threat. The payload is not yet widely detected—VirusTotal shows 5 out of 95 engines flagging the URL—demonstrating how rapidly emerging phishing domains can bypass initial screening layers. Users who encounter this domain should exercise extreme caution, as it leverages the trusted WixStudio subdomain to appear credible, potentially deceiving even security-aware individuals into entering sensitive credentials or downloading malicious content.

Technical analysis confirms this domain resolves to IP 34.144.206.118 and is secured with a valid Let’s Encrypt SSL certificate, further enhancing its authenticity. This IP is associated with cloud infrastructure commonly used by threat actors to host short-lived phishing pages. While the creation date and registrar details are not publicly disclosed due to Wix’s privacy protections, the domain’s integration with Wix’s platform suggests a possible compromise or spoofed account rather than a traditional malicious registration. Despite the absence of detections, the domain has not been flagged on any major threat intelligence blocklists, reinforcing the need for proactive monitoring and user vigilance.

To mitigate exposure to this threat, organizations and individuals should immediately block traffic to Trezioosrt.wixstudio.com at the network perimeter and DNS level. Users who may have interacted with the site should rotate passwords for all accounts accessed from the same device and enable multi-factor authentication where available. Additionally, inspecting network logs for connections to 34.144.206.118 can help identify potential compromise. Security teams are advised to monitor for similar Wix-hosted phishing domains, as threat actors frequently rotate through legitimate hosting services to evade detection. Reporting such domains to PhishDestroy and relevant CERT teams accelerates global threat intelligence updates and helps prevent broader victimization.