suit-official-trexor[.]wixstudio[.]com

Domain suit-official-trexor.wixstudio.com is assessed as a brand impersonation campaign targeting a hardware wallet service login interface. The page mimics an official desktop and web application portal to lure credential entry and potential seed phrase exposure. No explicit drainer kit attribution is confirmed from available telemetry, but the infrastructure is consistent with templated phishing deployments.

Technical telemetry shows a VirusTotal detection ratio of 5/95 security vendors. The resolving infrastructure maps to IP 34.144.206.118 and the domain is associated with a large US-based registrar. The domain appears on three independent blocklists (PhishDestroy, PhishingArmy, OISD), indicating active malicious classification across multiple feeds. The page title observed in intelligence feeds suggests an attempt to present itself as an official application distribution and management interface, reinforcing social engineering credibility.

At time of assessment the domain is reported offline, indicating takedown or sinkholing action. Despite inactivity, residual risk remains due to potential reactivation on similar infrastructure or cloning under alternate subdomains. Users encountering similar pages should treat them as high risk and avoid entering authentication data or recovery phrases. Continued monitoring of related IP space and domain variants is recommended to detect re-emergence.