setupledger[.]wixstudio[.]com

PhishDestroy identifies setupledger.wixstudio.com as an active crypto drainer domain currently under investigation. This threat poses a high risk to cryptocurrency holders by luring victims to fraudulent transaction portals that silently drain wallets of digital assets. The domain is hosted on Wix Studio infrastructure and masquerades as a legitimate financial service to gain user trust before initiating unauthorized transfers.

This domain was flagged with a crypto drainer payload and remains active despite zero detections on VirusTotal (0/95 engines). It resolves to IP address 34.144.206.118, which is associated with cloud hosting services and operates under a Let’s Encrypt SSL certificate to appear trustworthy. While the exact creation date is not yet confirmed, the domain is currently unlisted on major blocklists including Google Safe Browsing, PhishTank, and OpenPhish as of the latest scan. Trust scores from reputable threat intelligence platforms remain neutral due to the recent emergence of this campaign. The threat actor leverages Wix’s subdomain structure to rapidly deploy and rotate domains, complicating takedown efforts and evading detection.

To mitigate exposure to this crypto drainer, users must immediately block setupledger.wixstudio.com at the network and DNS levels. Cryptocurrency users should verify destination addresses via independent channels, avoid clicking links in unsolicited communications, and use hardware wallets or transaction simulation tools to detect anomalies. Organizations should implement URL filtering rules to block known crypto drainer domains and monitor outbound traffic for connections to suspicious IPs like 34.144.206.118. PhishDestroy continues to investigate this campaign and urges heightened vigilance in cryptocurrency transactions.