appsuit-trexertrezo[.]wixstudio[.]com

PhishDestroy identifies appsuit-trexertrezo.wixstudio.com as an active crypto-draining phishing campaign hosted on Wix’s subdomain platform. The site is designed to trick users into connecting a cryptocurrency wallet and signing malicious transactions that silently transfer funds to attacker-controlled addresses. Investigators note that the domain is currently weaponized with a JavaScript crypto-drainer payload that activates once a wallet connection is initiated, making it a high-risk endpoint for digital-asset holders. This domain was flagged by PhishDestroy’s pipeline on seed 2463a8 and is served from a Google Cloud Platform IP (34.144.206.118) using a valid Let’s Encrypt TLS certificate to evade browser warnings. VirusTotal currently shows 0 detections out of 95 engines, indicating low AV coverage and a window of opportunity for widespread abuse. Historical WHOIS data reveals the subdomain was created on an unknown date but is being actively updated, and public blocklist counts currently stand at 0, confirming its fresh and unlisted status. The absence of detections and listings underscores the urgency for proactive defense rather than reactive remediation. If you visited appsuit-trexertrezo.wixstudio.com, immediately disconnect your wallet, revoke any permissions granted via wallet settings, and transfer remaining assets to a clean wallet. Preserve browser cache and network logs for incident reporting to PhishDestroy or your security team. Avoid reusing seed phrases or private keys across services and enable hardware wallet signing for critical transactions to mitigate the impact of similar campaigns.