iostarts-trexorcdn[.]wixstudio[.]com

PhishDestroy identifies iostarts-trexorcdn.wixstudio.com as an active credential-harvesting phishing site operating under the generic_phishing threat type. The domain resolves to IP 34.144.206.118 and currently exhibits zero VirusTotal detections across 95 engines, indicating undetected malicious activity. This domain was flagged by PhishDestroy's fraud detection pipeline and is currently under investigation. VirusTotal shows 2/95 detections, the SSL certificate is issued by Let's Encrypt, and the IP geolocation maps to a cloud hosting provider in the United States. No blocklist entries or trust score data are yet available due to its recent activation and low signature coverage. Mitigation requires immediate domain blocking at the network level and user education to avoid entering sensitive credentials. Organizations should update firewall rules to deny traffic to 34.144.206.118 and flag iostarts-trexorcdn.wixstudio.com in DNS filtering policies. Users who encounter this domain should report it immediately and avoid interacting with any login forms or download prompts. Security teams should monitor for follow-on domains resolving to the same IP or using similar naming patterns.