us-trexorlogn[.]wixstudio[.]com

PhishDestroy identifies us-trexorlogn.wixstudio.com as an active malware distribution domain impersonating QuickBooks financial software to deceive users into downloading malicious payloads. The domain leverages the legitimate WixStudio platform to host fraudulent content, exploiting brand recognition to bypass initial scrutiny. Current status remains active as of the latest assessment, with threat actors likely refining tactics to enhance credibility.

This domain was flagged by 5 of 95 VirusTotal vendors, resolves to IP 34.144.206.118, and operates under a Let's Encrypt SSL certificate for perceived legitimacy. The infrastructure lacks historical blocklist entries, indicating a recently deployed campaign. Trust scores remain unverified due to the domain's infancy, though the absence of detections suggests a stealthy threat in its early stages.

While investigations continue, users should avoid interacting with us-trexorlogn.wixstudio.com entirely. Security teams are advised to monitor for associated IP 34.144.206.118 and update firewall rules to block inbound/outbound traffic. Report any encounters to financial institutions or cybersecurity platforms to aid in takedown efforts. Exercise caution with WixStudio-hosted domains and verify sender authenticity before engaging with unsolicited links or files.