trexxorsuite-trezo[.]wixstudio[.]com

PhishDestroy identifies trexxorsuite-trezo.wixstudio.com as an active generic phishing campaign mimicking PayPal’s login portal. The domain leverages Wix’s subdomain service to host a fraudulent interface designed to harvest user credentials. SSL encryption via Let’s Encrypt provides a false sense of legitimacy, while the absence of detections on VirusTotal (4/95) suggests evasion of immediate detection mechanisms. The infrastructure resolves to IP address 34.144.206.118, a Google Cloud Platform (GCP) host often abused for transient phishing operations. This domain was flagged using seed 51f409, with current analysis pending further investigation into its operational lifespan and propagation vectors. VirusTotal’s 4/95 detection ratio indicates low signature-based flagging, while the Let’s Encrypt SSL certificate (issued for *.wixstudio.com) obscures malicious intent through reputable branding. The WixStudio subdomain structure is a common tactic to bypass traditional domain reputation filters, as Wix domains are frequently repurposed for short-lived campaigns. No historical blocklist entries or trust score reductions were identified at the time of assessment. Mitigation requires immediate user caution: avoid interacting with this domain or any links embedded in unsolicited communications claiming to originate from PayPal. If credentials were entered, rotate passwords immediately and enable multi-factor authentication (MFA) on legitimate PayPal accounts. Report the domain to PayPal’s phishing team and local cybercrime units. For organizations, configure network filters to block IP 34.144.206.118 and monitor for lateral movement if credentials were compromised. Monitor for further infrastructure pivoting, as this campaign may evolve to evade detection.