startio-trexio-ai[.]wixstudio[.]com

This domain, startio-trexio-ai.wixstudio.com, was identified as a cryptocurrency credential harvesting site designed to mimic legitimate blockchain service portals. Analysis indicates the page employed social engineering tactics to deceive users into submitting wallet private keys or recovery phrases, likely through a fabricated token airdrop or staking interface. The infrastructure leveraged Wix Studio’s hosting environment, which allowed rapid deployment and evasion of traditional detection mechanisms during its active phase. Infrastructure analysis reveals the domain was registered through a major registrar on April 27, 2026, with resolution to the IP address 34.144.206.118, hosted on a cloud platform. The site was flagged by 13 out of 95 security vendors on a malware aggregation platform, while three independent blocklists—including PhishDestroy, PhishingArmy, and OISD—actively blocked access. A trust score of 0/100 further corroborates its malicious classification. The SSL certificate issued by Let’s Encrypt provided a false sense of legitimacy, while detected technologies such as React and Google Cloud CDN suggest a modern, scalable phishing operation. Users who interacted with this domain should immediately revoke any submitted credentials and transfer assets to a new wallet using a clean device. All connected sessions should be terminated, and a full system scan performed to detect potential secondary payloads. Given the high-risk nature of credential harvesting, affected individuals are advised to monitor transaction histories for unauthorized activity and report the incident to relevant security response teams for further mitigation.