us-trexor-iostart[.]wixstudio[.]com

This domain, us-trexor-iostart.wixstudio.com, was confirmed to facilitate credential theft targeting users through deceptive login interfaces. Analysis indicates the site impersonated legitimate services to harvest account credentials, likely for financial fraud or unauthorized access to sensitive platforms. The domain’s infrastructure was designed to appear authentic, leveraging trusted hosting providers and SSL certificates to evade initial suspicion. Evidence supporting this assessment includes detection by 16 out of 95 security vendors on VirusTotal, alongside presence on three security blocklists (PhishDestroy, PhishingArmy, and OISD). The domain was registered through GoDaddy.com, LLC, with a creation date of March 25, 2026, suggesting an attempt to exploit future-dated legitimacy. It resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employed technologies such as Wix, React, and Google Cloud CDN to mimic legitimate platforms. The SSL certificate was issued by Let’s Encrypt, further masking its malicious intent. Users who visited this domain or entered credentials should immediately revoke access to any accounts potentially exposed, enable multi-factor authentication, and monitor for unauthorized activity. Passwords for compromised accounts must be changed across all platforms where reused. Network administrators should block the domain and associated IP (34.144.206.118) at the perimeter to prevent further exposure. Given the domain’s current offline status, residual risk remains low, but vigilance is advised for related phishing campaigns leveraging similar infrastructure or tactics.