starting-trexor-io[.]wixstudio[.]com

PhishDestroy identifies starting-trexor-io.wixstudio.com as an active fake investment scam domain designed to trick users into depositing cryptocurrency or transferring funds under the guise of high-return trading opportunities. The site leverages the reputable WixStudio subdomain to appear legitimate while hosting fraudulent content, including fabricated account balances and withdrawal prompts. Threat actors often use Wix-hosted pages to bypass email security filters and social engineering victims into sharing sensitive financial information or completing unauthorized transactions. This domain is part of a broader campaign targeting users searching for cryptocurrency investment tools, with reports indicating similar domains registered within the past 30 days. This domain resolves to IP 34.144.206.118 and currently shows zero detections out of 95 VirusTotal engines, indicating it remains under the radar of mainstream security tools. Let's Encrypt issued its SSL certificate, further enhancing its perceived legitimacy. The domain was registered recently, with creation dates aligning with the observed uptick in fake investment scams aiming to exploit market volatility and user trust in recognizable platforms like Wix. Although blocklist counts are not yet available, the combination of low detection rates, recent registration, and active hosting infrastructure signals an emerging but high-risk threat. Users who visited starting-trexor-io.wixstudio.com should immediately cease further interaction with the site, including logging into any linked accounts or entering payment details. Review financial statements and credit reports for unauthorized transactions, and consider revoking any API keys or credentials shared with the domain. Report the incident to your bank or payment provider and submit a complaint to the FBI IC3 or your local cybercrime unit. To prevent future exposure, update browser security settings to block newly observed domains and avoid clicking on investment-related ads or links in unsolicited emails. The under_investigation status of this domain may change as additional intelligence is collected, so continuous monitoring is advised.