trezzoiosuite[.]wixstudio[.]com

PhishDestroy identifies trezzoiosuite.wixstudio.com as an active fake invoice suite phishing domain targeting Italian-speaking users.

This domain poses as a legitimate invoice management portal (Trezzo Suite) and is currently under investigation by multiple threat intelligence teams. According to VirusTotal data, trezzoiosuite.wixstudio.com was scanned by 95 security vendors and remains undetected with 3/95 positive flags as of today. The domain resolves to IP address 34.144.206.118 and is secured with a Let’s Encrypt SSL certificate. The WixStudio platform serves as the hosting provider, and domain registration details indicate recent creation; however, full registration data remains masked by the privacy-protected registrar. This domain has not yet been listed on major blocklists, including PhishTank, OpenPhish, or Google Safe Browsing, resulting in low community trust scores and high risk of evasion. Current WHOIS records show privacy protection, limiting historical and registrant transparency.

Currently, trezzoiosuite.wixstudio.com is classified as ACTIVE and remains unblocked across major browsers and security platforms. Recent user reports describe fraudulent invoice documents being delivered via email, directing victims to log in on this domain to view or pay fake invoices. The scam mimics a legitimate Italian business suite, likely exploiting the Trezzo brand name to lend credibility. Technical analysis reveals the site uses client-side scripting for form validation but lacks server-side fraud detection mechanisms. Due to its Wix-based infrastructure, takedown requests may face delays from the hosting provider, increasing operational risk.

Security teams and end users are advised to block trezzoiosuite.wixstudio.com at the network and DNS levels using indicators such as IP 34.144.206.118 and domain name. Exercise caution with any unsolicited invoice communications, especially those referencing Italian entities or payment portals. Report suspicious activity to your email provider and local CERT. Monitor financial accounts for unauthorized transactions if exposed. Organizations are encouraged to update email filtering rules to detect similar domain patterns and deploy browser-based URL reputation checks. Further monitoring is recommended as this domain may escalate in threat sophistication or be rehosted on alternative infrastructure.