trexer-appsuite[.]wixstudio[.]com

PhishDestroy identifies the domain trexer-appsuite.wixstudio.com as an active generic phishing campaign impersonating login credential theft pages, currently categorized with an elevated risk level. This domain operates as a crypto drainer, designed to harvest user credentials under the guise of a legitimate app suite login portal. The infrastructure leverages a Let’s Encrypt SSL certificate to appear legitimate and resolves to the IP address 34.144.206.118, which is hosted on Google Cloud Platform. This domain was flagged by 3 out of 95 VirusTotal security vendors at the time of analysis, indicating a low but present detection rate among industry tools.

This domain exhibits multiple red flags consistent with malicious infrastructure. The VirusTotal detection ratio of 3/95 suggests limited but notable recognition by security vendors, while the use of a Let’s Encrypt SSL certificate provides a false sense of security to users. The IP address 34.144.206.118 is associated with cloud hosting, which is commonly exploited by threat actors to rapidly deploy and rotate malicious domains. The domain is registered under Wix.com’s Wix Studio platform, which has been abused in numerous phishing campaigns due to its legitimate appearance and ease of setup. The low detection rate, combined with the use of a reputable hosting provider, highlights the stealthy nature of this campaign.

Users are strongly advised to avoid interacting with trexer-appsuite.wixstudio.com and to verify any suspicious links using PhishDestroy’s real-time scanning tool. If credentials or sensitive information were entered, users should immediately change passwords and enable multi-factor authentication (MFA) on all associated accounts. Organizations should block this domain at the network level using DNS filtering or firewall rules. Additionally, users should inspect URLs for inconsistencies, such as mismatched domains or unusual subdomains, and avoid entering sensitive information on untrusted pages. Always validate the legitimacy of login portals by visiting official websites directly.