trusrt-web3[.]wixstudio[.]com

PhishDestroy identifies trusrt-web3.wixstudio.com as an active Web3 wallet drainer phishing domain specifically targeting cryptocurrency users through deceptive wallet authentication interfaces. The domain mimics legitimate Web3 services—likely leveraging the trust associated with WixStudio hosting—to trick victims into connecting their wallets and authorizing malicious transactions. Security research indicates this infrastructure is part of a broader campaign aimed at draining digital assets from unsuspecting users, particularly those engaging with decentralized finance (DeFi) platforms or NFT marketplaces.

This domain exhibits several alarming technical indicators that confirm its malicious intent. VirusTotal detection stands at a concerning 2 out of 95 security vendors, suggesting low but growing recognition of the threat. The domain resolves to IP address 34.144.206.118, which is hosted on infrastructure associated with cloud services frequently abused by threat actors. The SSL certificate is issued by Let's Encrypt, a legitimate provider often exploited by attackers to establish trust through HTTPS encryption. The domain was registered recently and has already been blocked by industry leaders including MetaMask and SEAL, while appearing on multiple security blocklists. These combined factors indicate a rapidly deployed and actively monitored phishing operation.

As of current intelligence, trusrt-web3.wixstudio.com remains in active operation with elevated risk to potential victims. Immediate defensive actions include blocking the domain at DNS and network levels, and updating browser and wallet security extensions with the latest threat intelligence. While the domain has been flagged by major security platforms, the low VirusTotal detection rate suggests that many endpoint protections remain unaware of this specific threat. Users are strongly advised to verify all Web3-related URLs through official channels before interacting with wallet connection prompts, and to report any suspicious activity to their security teams or relevant blockchain monitoring services. The residual risk remains significant due to the domain's active status and the potential for further evasion or rebranding.