homesuite-trexor[.]wixstudio[.]com

PhishDestroy identifies homesuite-trexor.wixstudio.com as an active cryptocurrency drainer kit targeting unsuspecting victims under the guise of a legitimate service. The domain leverages WixStudio's hosting infrastructure to deploy malicious JavaScript payloads designed to siphon cryptocurrency from victims' wallets upon interaction. No direct brand impersonation was observed; however, the site mimics financial service interfaces to deceive users into connecting their wallets. The threat actor behind this domain employs obfuscation techniques to evade detection, including dynamic payload delivery and encrypted communications.

This domain resolves to IP address 34.144.206.118 and is secured with a Let's Encrypt SSL certificate, which may lend an air of legitimacy to unsuspecting users. VirusTotal analysis reveals a detection rate of 3 out of 95 security vendors, indicating a moderate but persistent threat. The domain was registered under Wix's infrastructure, which complicates takedown efforts due to the shared hosting environment. Creation date and registrar details remain obscured, but the domain's recent activity aligns with the observed drainer kit deployment. Google Safe Browsing (GSB) has not flagged this domain, and it appears on at least 3 known blocklists, though this count may underrepresent its actual prevalence.

As of the latest assessment, homesuite-trexor.wixstudio.com remains active and poses an elevated risk to cryptocurrency users. No takedown actions have been confirmed, leaving the threat operational. Users are advised to avoid interacting with this domain and to report any suspicious activity to their security teams. The remaining risk is elevated due to the domain's active status and the drainer kit's potential to target a wide user base. Security researchers are encouraged to monitor this domain for further developments and to update threat intelligence feeds accordingly.