desktop-cloud[.]wixstudio[.]com

PhishDestroy identifies desktop-cloud.wixstudio.com as an active brand impersonation scam designed to trick users into connecting crypto wallets to a malicious drainer. The site mimics the look and feel of a well-known cloud storage platform, luring victims with fake login or wallet-connect prompts. Once a wallet is connected, the drainer silently transfers tokens to attacker-controlled addresses, often draining entire balances within seconds. This campaign exploits trust in familiar brands to bypass user skepticism, making it highly effective against both casual and experienced users. This domain was flagged under seed 5ae685 after VirusTotal scans returned zero detections (0/95 engines) as of the latest update. The domain resolves to IP 34.144.206.118 and uses a valid Let’s Encrypt SSL certificate to appear legitimate. Infrastructure analysis shows the IP belongs to Google Cloud, which is frequently abused by threat actors for hosting short-lived scam pages. The domain was registered recently and is hosted on Wix’s platform, which has become a common vector for credential theft and crypto drainer campaigns due to its ease of use and low barrier to deployment. If you visited desktop-cloud.wixstudio.com, do not connect any wallets or enter credentials. Disconnect your device from the internet to prevent further unauthorized connections. Scan your system with updated antivirus software and revoke any wallet permissions granted to the site via your wallet’s connected app settings. Report the domain to your wallet provider and the platform hosting the page (Wix) with the URL and any transaction hashes if funds were stolen. Monitor your wallet for unauthorized transactions and consider transferring remaining assets to a cold wallet until the threat is neutralized.