connect-trexorcdn[.]wixstudio[.]com

This domain, connect-trexorcdn.wixstudio.com, operates as a phishing endpoint designed to mimic legitimate content delivery network (CDN) infrastructure. Attackers use it to harvest credentials, session tokens, or financial details by presenting users with fraudulent login portals or payment forms. The site may appear as part of a larger campaign distributing malicious links via email, SMS, or compromised websites, often leveraging urgency or fake security alerts to deceive victims. Analysis indicates the domain resolves to IP address 34.144.206.118 and remains active at the time of this report. VirusTotal shows zero detections across 95 security engines, suggesting the infrastructure is either newly deployed or employs evasion techniques to avoid automated detection. The domain is hosted on Wix Studio’s platform, which provides attackers with a low-cost, legitimate-looking environment to stage phishing operations without immediate red flags from hosting providers. If a user has interacted with this domain, they should immediately terminate any active sessions and revoke credentials entered on the site. Check browser history for unexpected redirects to connect-trexorcdn.wixstudio.com and clear cached data. Monitor accounts linked to the session for unauthorized activity, particularly those involving financial transactions or sensitive data. Users should report the domain to their organization’s security team or relevant authorities to aid in takedown efforts. Avoid re-engaging with the site or any associated links, as they may trigger additional malicious payloads.