explored-desktops[.]wixstudio[.]com

PhishDestroy identifies explored-desktops.wixstudio.com as a generic phishing domain currently under investigation for hosting a crypto drainer kit. The subdomain resides on WixStudio’s shared hosting platform and is designed to trick users into connecting crypto wallets under the guise of a desktop-related service. No specific brand impersonation has been confirmed at this stage, but the payload is consistent with clipboard and wallet-drainer malware observed in similar campaigns. The malicious infrastructure leverages Wix’s legitimate CDN to obscure its origin while delivering the drainer payload via JavaScript injection or fake download prompts. This approach allows the threat actor to evade basic network-level filtering and maintain operational persistence until flagged by security platforms.

Technical indicators confirm the domain resolves to IP 34.144.206.118 and is secured with a Let’s Encrypt SSL certificate. VirusTotal currently returns 8/95 detection detections, indicating low AV coverage. The domain was registered via Wix’s internal registrar and uses a recently created WixStudio subdomain structure, which limits historical WHOIS visibility. Google Safe Browsing (GSB) has not yet flagged the domain, and it remains absent from major threat intelligence blocklists as of this analysis. The lack of prior detections suggests either a newly deployed campaign or a carefully crafted evasion strategy targeting low-sophistication users.

Currently, the domain remains active and unblocked across most security platforms. PhishDestroy has flagged this domain for immediate analysis due to the high-risk nature of crypto drainer payloads. No takedown or mitigation has been initiated by hosting providers at this time. Users are strongly advised to avoid interacting with explored-desktops.wixstudio.com and verify its status on PhishDestroy before any wallet connection. The residual risk remains high given the absence of AV detections and GSB classification, requiring ongoing monitoring and proactive blocking by security teams.