trexo-io-started[.]wixstudio[.]com

Analysis of trexo-io-started.wixstudio.com indicates that the domain is actively leveraged for a generic phishing campaign. The site was first registered on 17 December 2016 through the Wix Studio platform, which is commonly used for rapid website deployment. The authoritative name servers are dns1.p08.nsone.net, dns2.p08.nsone.net, dns3.p08.nsone.net, and dns4.p08.nsone.net, suggesting hosting on the NSONE infrastructure.

Multiple defensive services have flagged the domain: PhishDestroy, MetaMask, and SEAL have listed it as blocked, and three independent security blocklists also contain the hostname. VirusTotal scans show that 14 of 91 antivirus and URL‑reputation engines return a positive detection for the domain, reinforcing the malicious assessment. No publicly available page title or content snapshot has been released, so the exact visual or functional characteristics of the landing page remain unknown.

However, the combination of early registration, use of a free‑form Wix sub‑domain, consistent blocking by reputable anti‑phishing tools, and a non‑trivial detection rate on VirusTotal provides sufficient evidence for classification as a high‑risk phishing infrastructure. Defenders should continue to block the domain at perimeter firewalls, DNS filters, and endpoint protection solutions, and should monitor any future resolution changes or hosting moves that might indicate a shift in the attacker's tactics. Ongoing observation of the NSONE name‑server set is advised to detect potential redeployment of the domain for new malicious campaigns.