suitesapp-trexo[.]wixstudio[.]com

Domain suitesapp-trexo.wixstudio.com has been identified as an active crypto drainer impersonating legitimate Suite Apps services. The threat leverages a bogus domain hosted on WixStudio to deceive users into connecting cryptocurrency wallets under the guise of app integration or updates. This domain was flagged by multiple threat intelligence sources, indicating a deliberate effort to siphon funds from unsuspecting victims. No specific drainer kit has been publicly disclosed, but the campaign exhibits classic credential and wallet theft tactics through fake authentication pages. This domain resolves to IP address 34.144.206.118 and is associated with a Let's Encrypt SSL certificate, which enhances its credibility. According to VirusTotal, 4 out of 95 security vendors flagged this domain as malicious, highlighting a moderate but concerning detection rate. The domain is registered through Wix.com and shows no signs of being flagged in Google Safe Browsing (GSB). However, it has appeared on one public blocklist, including PhishingArmy, indicating early-stage but active takedown efforts. As of the latest analysis, the domain remains active and poses an elevated risk to users interacting with Suite Apps-themed content. Immediate defensive actions include blocking the domain at the network perimeter and updating firewall rules to drop traffic to 34.144.206.118. Users should be alerted to verify all domain names when accessing Suite Apps services and avoid entering wallet credentials on untrusted pages. The risk remains elevated due to the domain’s active status and low initial detection rate.