starts-desktoplive[.]wixstudio[.]com

PhishDestroy identifies starts-desktoplive.wixstudio.com as an active cryptocurrency drainer domain currently under investigation for generic phishing activity. The site is hosted on WixStudio’s platform and presents a fraudulent desktop-themed lure to deceive visitors into connecting crypto wallets or entering seed phrases. No specific brand or drainer kit has been confirmed at this stage, but the domain’s naming convention suggests an attempt to mimic legitimate desktop support or software distribution portals. The threat actor is leveraging free hosting to reduce operational costs while maintaining plausible deniability through Wix’s legitimate infrastructure.

This domain resolves to IP 34.144.206.118 and is protected by a Let’s Encrypt SSL certificate, likely to enhance trust and avoid browser warnings. According to VirusTotal, the domain currently shows 0 detections out of 95 engines, indicating it remains undetected by most antivirus and threat intelligence platforms. The domain was created recently and is associated with WixStudio’s service platform, though its specific creation date is not publicly disclosed. As of now, Google Safe Browsing (GSB) has not flagged the domain, and no blocklist entries have been recorded in major threat intelligence feeds. The lack of detection suggests early-stage deployment or a highly evasive configuration.

The domain is currently active and poses an elevated risk due to its cryptocurrency drainer functionality targeting wallet connections or credential harvesting. Users should avoid interacting with starts-desktoplive.wixstudio.com and report any suspicious activity. Security teams are advised to monitor this domain for changes in detection status and to block the associated IP 34.144.206.118 at the network perimeter. The risk level remains under investigation but is considered active until further intelligence or takedown actions occur. Remaining risk includes continued phishing operations and potential expansion into broader credential theft campaigns.