myssouphuldappcdn[.]wixstudio[.]com

PhishDestroy identifies an active cryptocurrency drainer campaign targeting users via the domain myssouphuldappcdn.wixstudio.com (seed: 502ae7). This phishing domain masquerades as a legitimate application CDN, leveraging the WixStudio platform to host malicious payloads. The page is designed to deceive victims into connecting their crypto wallets and approving malicious transactions, characteristic of a generic but highly effective drainer kit. There are no immediate indicators of a brand impersonation (e.g., fake MetaMask or Ledger), suggesting this may be a standalone fraudulent service targeting crypto users directly. This domain was flagged during routine threat monitoring and has not yet been detected by security engines—achieving 4 out of 95 detections on VirusTotal at the time of analysis. It resolves to IP 34.144.206.118 via a Let's Encrypt SSL certificate, indicating an attempt to appear trustworthy. The domain is registered through Wix.com (via WixStudio), and its infrastructure suggests a short-lived campaign due to the use of a subdomain under wixstudio.com. As of this report, the domain is live, unblocked by Google Safe Browsing (GSB), and has zero listings on major threat blocklists. The creation date is under investigation, but the lack of detections implies recent deployment. The campaign remains active and is actively distributing malicious links via social engineering vectors such as fake support channels, airdrop scams, or impersonated wallet interfaces. Immediate action is required: users should avoid clicking any links to this domain and report it to their security teams. While the site currently operates undetected, it poses a high risk to cryptocurrency users due to the drainer’s automated transaction approval mechanisms. The domain should be added to network and endpoint blocklists immediately. Remaining risk is high due to the unflagged status and live operational status of the infrastructure.