desktopconnect[.]wixstudio[.]com

PhishDestroy identifies desktopconnect.wixstudio.com as an active crypto drainer phishing domain under investigation with seed c061d9. This domain mimics a legitimate login interface to trick users into connecting cryptocurrency wallets and initiating unauthorized transfers. The attack leverages a generic phishing kit designed to harvest wallet credentials and transaction approvals, enabling immediate fund drainage upon user interaction. No specific brand impersonation has been confirmed at this stage, but the domain’s structure suggests opportunistic targeting of crypto users rather than a targeted corporate or financial brand campaign. The exact technical indicators associated with this domain include a VirusTotal detection score of 0/95, indicating no current antivirus or security engine flagging despite active malicious behavior. The domain resolves to IP address 34.144.206.118 and is secured with a Let’s Encrypt SSL certificate to enhance credibility. The domain is hosted on Wix’s studio platform and was created recently; however, the precise creation date is not publicly disclosed in WHOIS records. Google Safe Browsing (GSB) has not yet flagged the domain, and public blocklist aggregators show zero listings at the time of analysis. This combination of low detection, recent infrastructure, and lack of historical reputation makes the threat both stealthy and potentially widespread. As of now, the domain remains active and is categorized as under investigation with a status of active. PhishDestroy continues to monitor this threat and has flagged it for further behavioral analysis. Users are strongly advised to avoid visiting desktopconnect.wixstudio.com and to verify any similar domains using PhishDestroy’s real-time threat lookup tool. The current risk level is classified as under_investigation, but the absence of detection and active hosting suggests imminent escalation if unchecked. Immediate caution and proactive blocking are recommended to prevent cryptocurrency losses.