trezsuitueapp[.]wixstudio[.]com

PhishDestroy identifies trezsuitueapp.wixstudio.com as an active fake login phishing domain under investigation for credential harvesting. This Wix-hosted subdomain mimics a legitimate service interface, likely targeting unsuspecting users with a spoofed authentication portal. The threat type is classified as generic_phishing with a current risk level of under_investigation, though behavioral analysis suggests high-risk intent.

This domain resolves to IP address 34.144.206.118 and is secured with a Let's Encrypt SSL certificate, likely to appear legitimate. VirusTotal currently reports 0/95 detections, indicating it remains undetected by most antivirus engines. The domain was created recently and registered through Wix's studio platform, leveraging a trusted hosting provider to evade traditional blocklists. As of this report, Google Safe Browsing (GSB) has not flagged the domain, and no public blocklists include it. These technical indicators suggest a newly deployed campaign operating below detection thresholds.

The domain remains active with a status of active, and PhishDestroy continues monitoring for behavioral shifts or payload updates. No formal takedown requests have been issued yet, leaving users vulnerable. While the immediate risk is classified as under_investigation, the absence of detections and SSL certification demands caution. Users are advised to avoid interacting with this domain and verify URLs via PhishDestroy before entering credentials. Remaining risk hinges on further intelligence collection and potential escalation to a high-risk classification.