suiteapp-eng[.]wixstudio[.]com

PhishDestroy identifies suiteapp-eng.wixstudio.com as an active crypto drainer impersonating the Wix brand, designed to deceive users into connecting cryptocurrency wallets before draining assets. This domain leverages a spoofed suite application interface to masquerade as a legitimate Wix service, specifically targeting users seeking web development or app integration tools. No known drainer kit signatures are associated with the domain at this stage, though the infrastructure suggests it may rely on generic JavaScript-based wallet drainers common in such campaigns.

This domain resolves to a single IP address (34.144.206.118) hosted on Google Cloud Platform, with an SSL certificate issued by Let's Encrypt to support HTTPS lures. According to VirusTotal aggregated scans, the domain remains undetected across 95 antivirus engines, indicating a low signature-based threat profile at present. The domain was registered using a privacy-protected registrar, with creation details obscured, and currently shows no presence on Google Safe Browsing or major public blocklists as of this assessment. The infrastructure’s lack of prior flagging suggests either a recently deployed or rapidly evolving threat actor operation.

Suiteapp-eng.wixstudio.com remains classified as an active threat under investigation, with PhishDestroy recommending immediate network and endpoint blocking of the IP and domain to mitigate exposure. Users should avoid accessing the link entirely and report any interactions to their security teams. While current detections are low, the presence of a Let's Encrypt certificate and Wix impersonation strongly indicate malicious intent aimed at cryptocurrency theft. This advisory will be updated upon completion of forensic sandbox analysis and additional threat intelligence correlation.