io-starts-trexor[.]wixstudio[.]com

This domain is flagged as a high-risk credential harvesting phishing site targeting users through deceptive infrastructure. Analysis indicates the domain was specifically designed to mimic legitimate services, likely to harvest login credentials, financial details, or other sensitive information. The threat type aligns with patterns observed in targeted phishing campaigns, where attackers exploit subdomains of reputable hosting platforms to evade initial scrutiny. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 15, 2026, through a large-scale registrar, and resolves to the IP address 34.144.206.118. It appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and is flagged by 10 out of 95 security vendors on a malware analysis platform. The SSL certificate is issued by a widely trusted provider, which may have been leveraged to create a false sense of legitimacy. Despite the current 404 error page, historical data suggests the domain previously hosted active phishing content, as evidenced by its inclusion on multiple threat intelligence feeds. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address at the network perimeter. Organizations should review logs for any prior connections to 34.144.206.118 or the domain itself, particularly from endpoints that may have interacted with the site before it was taken offline. User awareness training should emphasize the risks of credential harvesting via subdomains of legitimate platforms, and multi-factor authentication should be enforced to mitigate the impact of any potential credential exposure. Additionally, security teams should monitor for similar domains registered through the same registrar or resolving to the same IP range, as these may indicate follow-up campaigns.