trexor-appstarts[.]wixstudio[.]com

The domain trexor-appstarts.wixstudio.com is currently flagged as an active generic phishing site with an elevated risk rating. Infrastructure analysis shows the domain is hosted on Wix Studio infrastructure, as indicated by the four NSONE nameservers (dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, dns4.p08.nsone.net). Registration data confirms the domain was created on December 17, 2016 and was purchased through Wix Studio, a platform that permits rapid deployment of sub‑domains and often obscures the true operator.

VirusTotal scans report that 13 of 91 security vendors have flagged the domain, demonstrating that a subset of detection engines recognize malicious activity associated with it. Community‑based defenses have also responded: PhishDestroy has added the domain to its blocklist, and it appears on one additional security blocklist, suggesting that at least some threat‑intelligence feeds are aware of its use. No public information is available regarding SSL/TLS certificates, HTTP response codes, page titles, or any specific brand being impersonated, leaving the exact payload and lure mechanisms uncertain.

Defenders should treat the domain as a confirmed credential‑harvesting vector until further analysis clarifies its content. Recommended actions include adding the domain to corporate URL filtering and DNS blocklists, monitoring outbound traffic for connections to the Wix Studio IP ranges, and employing email gateway rules to detect and quarantine messages that reference the domain or its sub‑paths. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection status, and any observed malicious payloads should be submitted to threat‑share platforms to improve collective detection capability.