started-io-trexxer[.]wixstudio[.]com

The domain started-io-trexxer.wixstudio.com is listed as an active generic phishing infrastructure with an elevated risk rating as of July 29, 2026. Registration records show the domain was created on December 17, 2016 and provisioned through Wix Studio, a known website‑building service. Its authoritative DNS is supplied by the NS1 network, specifically dns1.p08.nsone.net through dns4.p08.nsone.net, indicating reliance on a third‑party DNS hosting platform. Threat intelligence indicates the site is blocked by the PhishDestroy service and appears on a single security blocklist, providing at least one independent denial of service.

VirusTotal analysis reports that 13 of 91 submitted security vendors flagged the domain, reinforcing the suspicion of malicious use. No additional public data such as IP address, ASN, geographic hosting, SSL certificate details, or HTTP response codes are present in the current intelligence set, leaving the underlying hosting environment uncharacterised. Defenders should prioritize the domain for immediate blocking in perimeter and endpoint controls, incorporate it into URL filtering policies, and monitor for any resolution changes that could reveal new hosting assets.

Continuous re‑evaluation is advised, as the lack of visible hosting artefacts may mask a dynamic infrastructure that could shift to new IP ranges or employ fast‑flux techniques. Organizations using Wix‑based services should remain vigilant for similar patterns, given the platform’s permissive registration model. The evidence base is limited to registration metadata, DNS delegation, blocklist inclusion, and vendor detections; therefore, further investigative steps such as active probing, passive DNS correlation, and sinkhole observation are recommended to enrich the attribution and to confirm any additional malicious payloads or credential‑harvesting modules that may be delivered through the site.