extnsin-us[.]wixstudio[.]com

PhishDestroy identifies extnsin-us.wixstudio.com as an active phishing domain leveraging the WixStudio platform to host a malicious browser extension drainer kit mimicking legitimate extension installers. The domain does not impersonate a specific brand but instead presents itself as a generic ‘extensions’ service, likely targeting users searching for popular browser extensions. The observed infrastructure suggests a low-sophistication but high-reach campaign aimed at users installing unauthorized or counterfeit extensions. The threat involves the exfiltration of cryptocurrency wallet credentials and sensitive browser data via a fraudulent installer payload delivered through the site hosted on Wix’s subdomain hosting service.

Technical indicators confirm elevated risk: VirusTotal detection rate stands at 3 out of 95 security vendors (3/95), the domain resolves to IP address 34.144.206.118 via Let’s Encrypt SSL, and is currently blocked by MetaMask and SEAL. This domain was registered through an unknown registrar and flagged by two independent security blocklists. The subdomain structure within WixStudio suggests opportunistic abuse of reputable hosting infrastructure to evade detection, while the presence of SSL indicates an attempt to appear legitimate. The combination of low detection, active blocking by security tools, and multi-platform targeting elevates the operational risk to users engaging with this domain.

This domain remains active and poses an ongoing threat to users attempting to download browser extensions. Immediate response includes continued blocking at network and endpoint levels, with security vendors urged to update signatures for extnsin-us.wixstudio.com and related payloads. Users are advised to avoid downloading extensions from unofficial sources, verify publisher signatures in browser stores, and use wallet protection tools. Remaining risk is elevated due to the domain’s active status, low detection coverage, and the continued abuse of legitimate hosting platforms. Regular monitoring and threat intelligence sharing are recommended to preempt further distribution.