proxy-bridge[.]wixstudio[.]com

PhishDestroy identifies proxy-bridge.wixstudio.com as an active crypto drainer impersonation domain, hosted on Wix Studio and designed to deceive users into connecting crypto wallets under the guise of proxy-bridge services. The threat actor leverages a generic landing page structure commonly associated with clipboard-modifying drainer kits, which silently replace wallet addresses pasted by victims with those controlled by the attacker. While the domain does not explicitly brand a major exchange or wallet provider, the term 'proxy-bridge' suggests a connection to proxy services in crypto ecosystems, possibly mimicking bridge protocols or routing tools to gain user trust. The domain’s use of a Wix Studio subdomain indicates a low-cost, high-availability hosting strategy typical of opportunistic phishing campaigns seeking short-lived operational windows. This domain resolves to IP address 34.144.206.118, a Google Cloud Platform (GCP) instance, and is secured with a Let’s Encrypt SSL certificate, likely to evade browser warnings and appear legitimate. According to VirusTotal, the domain currently shows 0 detections across 95 security vendors as of the latest scan. The domain is registered through Wix.com, leveraging their studio platform for rapid deployment. The creation date is under investigation, but the domain remains active and accessible. Google Safe Browsing (GSB) status is currently unknown, and the domain has not yet been widely blocklisted, indicating a newly emerged or stealthily operated threat. These technical indicators suggest a campaign in its early operational phase, prioritizing speed and evasion over sustained infrastructure. The domain is currently flagged as 'active' with a risk status of 'under_investigation' by PhishDestroy’s monitoring systems. Immediate response actions include categorization as a high-priority crypto drainer threat and the addition of the domain and its resolving IP to internal and partner blocklists. Users are strongly advised to avoid interacting with this domain, verify any 'proxy-bridge' related services through official channels, and inspect wallet transaction histories for unauthorized transfers. Remaining risk is assessed as moderate due to the domain’s current low detection rate and lack of widespread blocking, but the transient nature of Wix-hosted and cloud-resolved phishing domains typically results in rapid takedown once identified. Continuous monitoring is essential to prevent wallet compromise and financial loss.