read-desktop[.]wixstudio[.]com

PhishDestroy identifies read-desktop.wixstudio.com as a brand impersonation phishing domain currently under investigation for deploying a crypto drainer. This domain mimics the legitimate Wix Studio platform to deceive users into connecting cryptocurrency wallets or submitting credentials, which are then drained by threat actors. The risk level is currently flagged as under_investigation, but active phishing campaigns often escalate rapidly, making this a high-priority concern for crypto users and Wix Studio customers. Immediate caution is advised when encountering this domain, as it is designed to harvest sensitive data under false pretenses.

This domain exhibits several technical indicators of malicious intent. SSL certification is provided by Let's Encrypt, which is not inherently suspicious but is commonly exploited by threat actors to establish false trust. The domain resolves to IP address 34.144.206.118, hosted on Google Cloud infrastructure, which is frequently abused for phishing due to its scalability and anonymity. VirusTotal currently shows 4/95 detections, indicating that security vendors have not yet flagged this domain, likely due to its recent activation or evasion tactics. The domain is registered under Wix.com’s official registrar, Wix Domains, which could mislead users into assuming legitimacy. However, the subdomain 'read-desktop.wixstudio.com' deviates from standard Wix Studio URLs, which typically follow patterns like '*.wixstudio.site' or '*.wixsite.com'. Additionally, the domain’s recent creation date (seed fc0704) and lack of presence on major blocklists suggest it is a newly deployed threat with untracked history.

Mitigation for this brand impersonation phishing attack requires proactive user education and technical safeguards. Users should verify the exact URL of any Wix-related service by cross-referencing it with official Wix communications or bookmarks. Never connect cryptocurrency wallets or enter credentials on unfamiliar subdomains, especially those using 'wixstudio.com' in a non-standard format. Employ browser extensions such as WalletGuard or Etherscan’s Phishing Detector to warn against crypto drainer domains. Organizations should block IP 34.144.206.118 at the network level and monitor for related domains mimicking Wix’s infrastructure. If interaction with this domain has already occurred, immediately revoke wallet connections via your crypto wallet’s approvals section and change any reused passwords. Report the domain to PhishDestroy and Wix’s abuse team to expedite takedown efforts.