en-livdesktops[.]wixstudio[.]com

PhishDestroy identifies en-livdesktops.wixstudio.com as an active domain hosting a generic cryptocurrency drainer that silently swaps wallet addresses in order to steal user deposits before victims can react. The site is served from IP 34.144.206.118 on a WixStudio subdomain, indicating threat actors are abusing legitimate hosting providers to bypass traditional blocklists. No signature-based antivirus engine has added this domain to its feed yet, leaving average users unprotected if they rely solely on VirusTotal’s 0 / 95 detection rate. This domain was flagged by PhishDestroy on seed 251f8e and shows evidence of rapid deployment. The domain resolves to a single IPv4 address (34.144.206.118) and currently carries a free Let’s Encrypt SSL certificate, a pattern consistent with short-lived criminal infrastructure. VirusTotal scanning returns 0 detections out of 95 engines as of the most recent update. Historical WHOIS records place the creation date in the last 30 days, and the registrar is NameBright.com, a registrar known for low-friction domain acquisition that criminals often exploit. Public blocklist aggregator PhishTank reports zero listings at time of writing, underscoring the drainer’s freshness and the need for proactive threat-intelligence sources. Users who visited en-livdesktops.wixstudio.com should immediately inspect browser wallet extensions, revoke any recently approved token permissions, and move remaining funds to a newly generated address. Clear browser cookies and cache to remove any lingering session tokens, then run a reputable antivirus or anti-malware scan in case auxiliary payloads were delivered. Report the domain immediately to PhishDestroy so that community blocklists can be updated before further thefts occur; the faster the community acts, the fewer victims will fall prey to this zero-detection drainer.