connectapp-trexor[.]wixstudio[.]com

Analysis of the domain connectapp-trexor.wixstudio.com indicates ongoing phishing activity as of July 23, 2026. The domain is currently active and resolves to the IP address 162.159.143.12, which is associated with infrastructure managed by Wix.com Ltd. Infrastructure review reveals the domain was registered through Wix, a platform commonly used for both legitimate and malicious purposes. Nameserver records return an NS_NOT_FOUND status, suggesting potential misconfiguration or deliberate obfuscation of DNS routing. The domain appears on one security blocklist, specifically PhishDestroy, which has flagged it for phishing-related threats.

No detections were reported by the 91 vendors that scanned the domain on VirusTotal, though the absence of detections does not confirm safety and may reflect delayed or incomplete coverage. Defenders should note that the domain’s hosting provider, Wix, is a known vector for phishing campaigns due to its ease of deployment and free-tier offerings. The IP address 162.159.143.12 is part of a larger network range that has historically hosted both benign and malicious content, requiring additional scrutiny. While the exact nature of the phishing content remains unconfirmed, the domain’s presence on a security blocklist and its active status warrant immediate action.

Organizations are advised to block or monitor traffic to this domain, particularly if it aligns with internal risk profiles for credential harvesting or social engineering. Further investigation, including sandbox analysis or manual review of the site’s content, is recommended to determine the specific phishing kit or targeted brand, if any. Given the domain’s registration under Wix, defenders should also assess whether other subdomains under wixstudio.com exhibit similar patterns.