tresuite-trezo[.]wixstudio[.]com

tresuite-trezo.wixstudio.com is a recently flagged domain associated with a generic phishing threat, specifically identified as a cryptocurrency drainer scam. The site operates under the WixStudio platform, leveraging its subdomain hosting to appear legitimate. No known brand impersonation or affiliated drainer kit signatures have been confirmed at this stage, though the generic_phishing classification suggests opportunistic credential or wallet theft tactics targeting crypto users.

Technical indicators reveal a low detection profile, with VirusTotal currently scoring 9/95 despite active phishing activity. The domain resolves to IP 34.144.206.118 and utilizes a valid Let's Encrypt SSL certificate for HTTPS encryption. Registration details remain unverified due to Wix’s subdomain policies, but the IP block (34.144.206.0/24) is associated with Google Cloud services, a common hosting provider for transient phishing infrastructure. The domain’s creation date and registrar remain obscured by Wix’s masking, though the platform’s use implies recent deployment. As of this assessment, the domain shows no presence on Google Safe Browsing (GSB) blocklists and remains absent from major threat intelligence feeds.

The domain is currently active and under investigation, with no immediate remediation actions taken by hosting providers or registrars. PhishDestroy identifies this as a high-risk threat due to the absence of detections and the targeting of cryptocurrency users. Users are advised to avoid interaction entirely and report the domain via browser-based phishing tools. Remaining risk is elevated given the lack of detections and the potential for rapid infrastructure rotation. Proactive blocking of the IP (34.144.206.118) and domain is recommended for organizations with threat intelligence capabilities.