deviceapp-trexio[.]wixstudio[.]com

PhishDestroy identifies deviceapp-trexio.wixstudio.com as a credential-harvesting domain posing as a legitimate application service. The domain employs a deceptive naming pattern mimicking 'Trexio', a known service, to trick users into entering sensitive credentials. No advanced drainer kit was observed, but the site’s structure suggests low-effort phishing aimed at harvesting login details under false pretenses. The domain resides on the WixStudio platform, which may be exploited for hosting due to its user-friendly interface and low barrier to creation.

This domain resolves to IP 34.144.206.118 and is powered by a Let’s Encrypt SSL certificate, enhancing its perceived legitimacy. According to VirusTotal, it remains undetected with 6/95 flags as of the latest scan (seed d4e6de). While the hosting provider and SSL issuance suggest benign infrastructure, the domain’s content and intent are malicious. Creation and registration details remain unverified through public sources, but the presence of a live phishing page has been confirmed via active scanning. The domain has not been flagged on Google Safe Browsing (GSB) and remains absent from major threat intelligence blocklists, indicating a newly deployed or under-monitored threat infrastructure.

The domain is currently active and under active investigation by threat intelligence teams. PhishDestroy has flagged the page for credential harvesting and is monitoring for further infrastructure shifts or domain mutations. Users are strongly advised to avoid interacting with deviceapp-trexio.wixstudio.com and to report any suspicious activity to their security teams. While the current risk is classified as 'active' with low detection coverage, the potential for rapid expansion and user targeting remains a concern. Organizations should implement network-level blocking for the domain and its associated IP address (34.144.206.118) to mitigate exposure. Further intelligence will be released as the investigation develops.