apps-coin-ext[.]wixstudio[.]com

The domain apps-coin-ext.wixstudio.com has been identified as an active cryptocurrency drainer campaign leveraging deceptive branding to impersonate Coinbase, a well-known crypto exchange platform. Threat intelligence sources have flagged this domain as a high-risk security concern, with current status listed as active and under investigation by multiple security vendors.

PhishDestroy identifies this domain as a malicious crypto drainer targeting unsuspecting users by leveraging Coinbase’s branding to facilitate unauthorized cryptocurrency transactions. This domain was flagged by 9 of 95 VirusTotal vendors, highlighting its evasive nature against common detection mechanisms. The domain resolves to IP address 34.144.206.118 and operates under Let’s Encrypt SSL certification. Additional telemetry indicates the domain is associated with WixStudio hosting services and has been blocked by OpenPhish, PhishingArmy, MetaMask, and SEAL. As of the latest assessment, this domain appears on 4 security blocklists, suggesting a distributed and persistent threat vector.

Despite its current lack of detections on VirusTotal, this domain presents a significant risk due to its active status and the observed evasion tactics employed. The absence of detections should not be misconstrued as a sign of safety. Users and organizations are strongly advised to avoid interacting with this domain and verify any suspicious links or communications using PhishDestroy’s threat intelligence platform. Immediate actions include blocking the domain and IP address at the network perimeter, updating endpoint detection rules, and conducting user awareness training to mitigate potential exposure. Continuous monitoring of this domain is recommended to ensure proactive threat containment.