en-cryto-com[.]wixstudio[.]com

This domain, en-cryto-com.wixstudio.com, is flagged as a high-risk brand impersonation threat targeting Crypto.com, a prominent cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic the legitimate brand’s appearance and functionality, likely to deceive users into disclosing sensitive credentials or transferring funds to attacker-controlled wallets. No specific drainer kit signatures were detected in the available data, but the infrastructure aligns with known phishing campaigns leveraging cloud-hosted platforms for rapid deployment and evasion.

Technical indicators confirm the domain’s malicious intent with a VirusTotal detection score of 13/95 security vendors, signaling widespread recognition as a phishing resource. The domain was registered through GoDaddy.com, LLC on April 27, 2026, an anomalous future date suggesting potential manipulation of registration records or a placeholder entry. It resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employs technologies such as Wix, React, Envoy, and Google Cloud CDN, which are commonly abused for scalability and anonymity. The domain appears on three security blocklists, including PhishDestroy and PhishingArmy, and was assigned a trust score of 0/100 by Gridinsoft. Despite using a Let’s Encrypt SSL certificate to feign legitimacy, the page currently returns a 404 error, indicating it may have been taken offline or moved to evade detection.

As of the latest assessment, en-cryto-com.wixstudio.com is offline, likely due to takedown efforts or voluntary abandonment by the threat actor. However, the residual risk remains high, as the domain’s infrastructure and registration details could be repurposed for future campaigns. Users and organizations are advised to block the domain and its associated IP address at the network level, monitor for similar impersonation attempts, and verify the authenticity of any communication claiming affiliation with Crypto.com. Security teams should treat this domain as part of a broader pattern of cryptocurrency-related phishing and prioritize user education on recognizing brand impersonation tactics.