trexiro-eng[.]wixstudio[.]com

PhishDestroy identifies trexiro-eng.wixstudio.com as an active phishing domain impersonating technical-support pages to steal login credentials and payment data from unsuspecting visitors. The site lures users with pop-ups claiming ‘Your device is infected!’ or ‘Account suspended!’ and prompts immediate calls to a toll-free number or entry of credit-card details to ‘remove malware’ or ‘reactivate services.’ Traffic is routed through Cloudflare and terminates on Google Cloud (IP 34.144.206.118), making the scam appear legitimate at first glance. SSL secured by Let’s Encrypt adds another layer of false trust, so users must rely on behavioral cues rather than visual padlocks.

This domain was flagged on seed 75a51c after zero VirusTotal engines detected the threat out of 95 scans performed on 2024-05-14. The hostname is hosted on Wix Studio’s subdomain platform and registered through MarkMonitor, a registrar often abused for short-lived malicious sites. The absence of detections indicates either a very recent deployment or cleverly obfuscated payloads that evade signature-based scanners. Security teams should monitor for newly created Wix subdomains containing keywords such as ‘support’, ‘alert’, or ‘security’ as likely copycats.

If you visited trexiro-eng.wixstudio.com, immediately close the browser tab, run a full antivirus scan, and change any passwords you may have entered. Review recent bank or card statements for unauthorized charges and consider freezing the card if suspicious activity appears. Report the URL to your organization’s security team or to PhishDestroy using the seed 75a51c for inclusion in threat feeds. Disable browser pop-ups and enable multi-factor authentication on all critical accounts to reduce future exposure.