usertrexrio[.]wixstudio[.]com

This domain, usertrexrio.wixstudio.com, is identified as a credential harvesting phishing site targeting users of an unspecified portal service. Analysis indicates the page mimics a legitimate login interface to capture sensitive credentials, though no specific brand impersonation or drainer kit has been confirmed at this stage. The infrastructure appears designed for short-term exploitation, consistent with opportunistic phishing campaigns. Infrastructure analysis reveals the domain was registered on April 13, 2026, through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. Detection metrics show 13 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on one additional security blocklist. Google Safe Browsing status is not explicitly listed, but the domain is actively blocked by at least one threat intelligence feed. At present, the domain has been taken offline, likely due to hosting provider intervention or registrar enforcement. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Organizations are advised to monitor for credential reuse attempts and implement multi-factor authentication to mitigate potential account compromise. The elevated detection count and rapid takedown suggest the campaign was identified and neutralized efficiently, though similar domains may emerge using comparable infrastructure.